huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
possible fallback from untrusted to trusted X11 forwarding
CVE: CVE-2016-1908
Component: openssh
CWE: CWE-284
Severity: Moderate
Release date: 2016-01-14T00:00:00+00:00

An access flaw was discovered in OpenSSH; the OpenSSH client did not correctly handle failures to generate authentication cookies for untrusted X11 forwarding. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the OpenSSH server daemon (sshd) will be restarted automatically.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite
CVE: CVE-2016-5418
Component: libarchive
CWE: CWE-22
Severity: Important
CVSS v3: 7.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-09-12T00:00:00+00:00

A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The following images are included in this errata:

openshift3/openvswitch:v3.1.1.7
openshift3/ose-pod:v3.1.1.7
openshift3/ose:v3.1.1.7
openshift3/ose-docker-registry:v3.1.1.7
openshift3/ose-keepalived-ipfailover:v3.1.1.7
openshift3/ose-recycler:v3.1.1.7
openshift3/ose-f5-router:v3.1.1.7
openshift3/ose-deployer:v3.1.1.7
openshift3/node:v3.1.1.7
openshift3/ose-sti-builder:v3.1.1.7
openshift3/ose-docker-builder:v3.1.1.7
openshift3/ose-haproxy-router:v3.1.1.7
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The following images are included in this errata :
openshift3/openvswitch:v3.2.1.15
openshift3/ose-pod:v3.2.1.15
openshift3/ose:v3.2.1.15
openshift3/ose-docker-registry:v3.2.1.15
openshift3/ose-keepalived-ipfailover:v3.2.1.15
openshift3/ose-recycler:v3.2.1.15
openshift3/ose-f5-router:v3.2.1.15
openshift3/ose-deployer:v3.2.1.15
openshift3/node:v3.2.1.15
openshift3/ose-sti-builder:v3.2.1.15
openshift3/ose-docker-builder:v3.2.1.15
openshift3/ose-haproxy-router:v3.2.1.15
openshift3/metrics-heapster:3.2.1-4
SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
CVE: CVE-2016-7425
Component: kernel
CWE: CWE-122
Severity: Low
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-09-15T00:00:00+00:00

A heap-buffer overflow vulnerability was found in the arcmsr_iop_message_xfer() function in 'drivers/scsi/arcmsr/arcmsr_hba.c' file in the Linux kernel through 4.8.2. The function does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. This can potentially cause kernel heap corruption and arbitrary kernel code execution.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. 6, 7 and Red Hat Enterprise MRG-2 as only the privileged user can exploit the flaw.

Remediation:
API server does not validate client-provided intermediate certificates correctly
CVE: CVE-2016-7075
Component: 3
CWE: CWE-295
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2016-10-10T00:00:00+00:00

It was found that Kubernetes did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.


Remediation:
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

To apply this update, see the following cluster upgrade documentation that 
relates to your installed version of OpenShift Container Platform.

For OpenShift Container Platform 3.3:

https://docs.openshift.com/container-platform/3.3/install_config/upgrading/automated_upgrades.html#upgrading-to-ocp-3-3-asynchronous-releases

For OpenShift Container Platform 3.2:

https://docs.openshift.com/enterprise/3.2/install_config/upgrading/automated_upgrades.html#upgrading-to-openshift-enterprise-3-2-asynchronous-releases

For OpenShift Container Platform 3.1:

https://docs.openshift.com/enterprise/3.1/install_config/upgrading/automated_upgrades.html#upgrading-to-openshift-enterprise-3-1-asynchronous-releases
Multiple vulnerabilities
CVE: CVE-2016-10326
Component: libosip2
Release date: 2016-01-01T00:00:00+00:00

In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
various userparams allow %pipe% in paths, allowing remote shell
CVE: CVE-2016-7976
Component: ghostscript
CWE: CWE-20
Severity: Important
CVSS v3: 7.1/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Release date: 2016-09-30T00:00:00+00:00

The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.


Remediation:
insecure error log file handling in mysqld_safe (CPU Oct 2016)
CVE: CVE-2016-6664
Component: mysql
Severity: Moderate
CVSS v3: 7.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-10-19T00:00:00+00:00

A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
use-after-free / double-free in JPC encoder
CVE: CVE-2016-9591
Component: jasper
CWE: CWE-416
Severity: Low
CVSS v3: 6.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-12-16T00:00:00+00:00

A use-after-free flaw was found in the way JasPer, before version 2.0.12, decode certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.


Remediation:
IV Reuse in GCM Mode
CVE: CVE-2016-7798
Component: ruby
Severity: Moderate
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-09-19T00:00:00+00:00

The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.


Remediation:
A possible workaround to this flaw is, when using aes-256-gcm mode, always set the key first and then the iv. For example when setting random keys and iv use the following code segment:

key = cipher.random_key
iv = cipher.random_iv
Parameter injection via mail() function
CVE: CVE-2016-10074
Component: php-swiftmailer
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-12-28T00:00:00+00:00

The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CR0.TS and CR0.EM not always honored for x86 HVM guests (XSA-190)
CVE: CVE-2016-7777
Component: xen
Severity: Moderate
CVSS v3: 6.2/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2016-10-04T00:00:00+00:00

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.


Remediation:
heap-buffer-overflow in sfntly
CVE: CVE-2016-1709
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-07-20T00:00:00+00:00

Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Multiple vulnerabilities fixed in 3.0.4, 2.9.6, 2.8.12 and 2.7.14
CVE: CVE-2016-3734
Component: moodle
Release date: 2016-05-17T00:00:00+00:00

Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free in GetStaticInstance in WebRTC (MFSA 2016-33)
CVE: CVE-2016-1973
Component: Mozilla
Severity: Important
Release date: 2016-03-08T00:00:00+00:00

Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via unspecified vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
unspecified vulnerability in subcomponent: Server: Options (CPU April 2016)
CVE: CVE-2016-0661
Component: mysql
Severity: Low
Release date: 2016-04-21T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
heap corruption in ffmpeg
CVE: CVE-2016-5199
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-11-09T00:00:00+00:00

An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted video file.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
9pfs: memory leakage via proxy/handle callbacks
CVE: CVE-2016-9913
Component: Qemu
CWE: CWE-244
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2016-11-21T00:00:00+00:00

Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup.


Remediation:
Out-of-bounds read in print_explroc_content
CVE: CVE-2016-5033
Component: libdwarf
CWE: CWE-125
Severity: Low
Release date: 2016-05-18T00:00:00+00:00

The print_exprloc_content function in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


Remediation:
Null pointer dereference in formUpdateBuffer
CVE: CVE-2016-9440
Component: w3m
CWE: CWE-476
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-08-19T00:00:00+00:00

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.


Remediation:
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-4272
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.


Remediation:
Insecure temporary file used when generating certificate for Pulp Nodes
CVE: CVE-2016-3108
Component: pulp
CWE: CWE-377
Severity: Moderate
Release date: 2016-04-13T00:00:00+00:00

It was found that the private key for the node certificate was contained in a world-readable temporary file. A local user could possibly use this flaw to gain access to the private key information in the temporary file.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied and that the Satellite is updated to the most recent 6.1.x release. 

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en/red-hat-satellite/6.2/single/installation-guide#upgrading_satellite_server_and_capsule_server
PixarLogDecode Heap Buffer Overflow
CVE: CVE-2016-5875
Component: libtiff
CWE: CWE-122
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-25T00:00:00+00:00

No description is available for this CVE.

Statement: This security flaw is addressed by the patch released for CVE-2016-5320. Therefore Red Hat Enterprise Linux packages are not affected.

Remediation:
Heap use-after-free in xmlDictComputeFastKey
CVE: CVE-2016-1836
Component: libxml2
CWE: CWE-416
Severity: Moderate
Release date: 2016-05-23T00:00:00+00:00

Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to cause a denial of service via a crafted XML document.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications linked to the libxml2 library must be restarted, or the system rebooted.
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

After installing the updated packages, the httpd daemon will be restarted automatically.
two enrolment-related web services don't check course visibility
CVE: CVE-2016-0724
Component: moodle
Release date: 2016-01-18T00:00:00+00:00

The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference in the pfd14_pop_transparency_group function
CVE: CVE-2016-10218
Component: ghostscript
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-12-19T00:00:00+00:00

The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.


Remediation:
SafeBrowsing protection mechanism bypass
CVE: CVE-2016-5176
Component: chromium-browser
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-09-29T00:00:00+00:00

Google Chrome before 53.0.2785.113 allows remote attackers to bypass the SafeBrowsing protection mechanism via unspecified vectors.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Multiple vulnerabilities fixed in 4.0.10.18, 4.4.15.9 and 4.6.5 versions
CVE: CVE-2016-9856
Component: phpMyAdmin
Release date: 2016-11-25T00:00:00+00:00

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
out of bounds write
CVE: CVE-2016-2037
Component: cpio
CWE: CWE-787
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-01-19T00:00:00+00:00

The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.


Remediation:
universal xss in blink
CVE: CVE-2016-5208
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-12-01T00:00:00+00:00

Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Unsigned integer underflow _gdContributionsAlloc()
CVE: CVE-2016-10166
Component: gd
CWE: CWE-190
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2016-08-06T00:00:00+00:00

Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
denial of service vulnerability in BGP routing daemon
CVE: CVE-2016-4049
Component: quagga
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-04-27T00:00:00+00:00

A denial of service flaw was found in the Quagga BGP routing daemon (bgpd). Under certain circumstances, a remote attacker could send a crafted packet to crash the bgpd daemon resulting in denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the bgpd daemon must be restarted for the update to take effect.
qemu incautious about shared ring processing (XSA-197)
CVE: CVE-2016-9381
Component: xen
Severity: Important
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2016-11-22T00:00:00+00:00

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.


Remediation:
SPICE dissector large loop (wnpa-sec-2016-16)
CVE: CVE-2016-4419
Component: wireshark
Severity: Moderate
Release date: 2016-02-26T00:00:00+00:00

epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial of service (large loop) via a crafted packet.


Remediation:
Stack overflow vulnerability in libiberty demangler
CVE: CVE-2016-6131
Component: gcc,gdb,binutils,libitm
CWE: CWE-674
Severity: None
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-06-29T00:00:00+00:00

The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types.

Statement: Red Hat Product Security determined that this flaw was not a security vulnerability. See the Bugzilla link for more details.

Remediation: