huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
memory corruption in cross-process frames
CVE: CVE-2016-1661
Component: chromium-browser
Severity: Important
Release date: 2016-04-28T00:00:00+00:00

Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted web site, related to BindingSecurity.cpp and DOMWindow.cpp.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
multiple code execution issues fixed in APSB16-04
CVE: CVE-2016-0973
Component: flash-plugin
Severity: Critical
Release date: 2016-02-09T00:00:00+00:00

Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via a URLLoader.load call, a different vulnerability than CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Stack overflow when parsing deeply nested DTD
CVE: CVE-2016-4463
Component: xerces-c
CWE: CWE-121
Severity: Moderate
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2016-06-29T00:00:00+00:00

A stack exhaustion flaw was found in the way Xerces-C XML parser handled deeply nested DTDs. An attacker could potentially use this flaw to crash an application using Xerces-C by tricking it into processing specially crafted data.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
multiple flaws fixed in 1.27.1, 1.26.4 and 1.23.15
CVE: CVE-2016-6331
Component: mediawiki
Release date: 2016-08-20T00:00:00+00:00

ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Invalid handling of +CIPHER operator
CVE: CVE-2016-3099
Component: mod_nss
CWE: CWE-392
Severity: Low
Release date: 2016-04-05T00:00:00+00:00

A flaw was found in the way mod_nss parsed certain OpenSSL-style cipher strings. As a result, mod_nss could potentially use ciphers that were not intended to be enabled.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The httpd service must be restarted for this update to take effect.
multiple code execution issues fixed in APSB16-39
CVE: CVE-2016-7873
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-12-13T00:00:00+00:00

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the PSDK class related to ad policy functionality method. Successful exploitation could lead to arbitrary code execution.


Remediation:
heap-buffer-overflow read in coders/hdr.c
CVE: CVE-2016-7520
Component: ImageMagick
CWE: CWE-122
Severity: Low
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-01-13T00:00:00+00:00

Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
vmware_vga: OOB stack memory access when processing svga command
CVE: CVE-2016-7170
Component: Qemu
CWE: CWE-121
Severity: Moderate
CVSS v3: 4.2/CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Release date: 2016-09-08T00:00:00+00:00

Quick Emulator (QEMU) built with the VMware-SVGA chipset emulation support is vulnerable to an OOB stack memory write issue. It could occur while processing VGA commands in 'vmsvga_fifo_run' routine. A privileged user inside guest could use this flaw to crash the QEMU process resulting in DoS.


Remediation:
MXIT File Transfer Length Memory Disclosure Vulnerability
CVE: CVE-2016-2372
Component: pidgin
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2016-06-21T00:00:00+00:00

An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.


Remediation:
remote attackers can modify the roster and intercept messages via a crafted roster-push IQ stanza
CVE: CVE-2016-9928
Component: mcabber
CVSS v3: 4.8/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2016-12-09T00:00:00+00:00

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Setting empty VNC password allows access to unauthorized users
CVE: CVE-2016-5008
Component: libvirt
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-01-01T00:00:00+00:00

It was found that setting a VNC password to an empty string in libvirt did not disable all access to the VNC server as documented, instead it allowed access with no authentication required. An attacker could use this flaw to access a VNC server with an empty VNC password without any authentication.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, libvirtd will be restarted automatically.
Privilege escalation due to improper guarding of IPC communication
CVE: CVE-2016-7035
Component: pacemaker
CWE: CWE-285
Severity: Important
CVSS v3: 8.5/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2016-11-03T00:00:00+00:00

An authorization flaw was found in Pacemaker, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.


Remediation:
Cross-site scripting (XSS) in kibana up to 4.3 and before 4.6.2
CVE: CVE-2016-10366
Component: kibana
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2016-01-01T00:00:00+00:00

Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack.


Remediation:
buffer overflow in Jpeg2kEncode.c
CVE: CVE-2016-3076
Component: python-pillow
CWE: CWE-122
Severity: Moderate
Release date: 2016-04-04T00:00:00+00:00

Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted Jpeg2000 file.


Remediation:
multiple code execution issues fixed in APSB16-25
CVE: CVE-2016-4249
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-07-12T00:00:00+00:00

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Remediation:
XXE in SVG files
CVE: CVE-2016-9181
Component: perl-Image-Info
CWE: CWE-611
Severity: Low
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2016-09-27T00:00:00+00:00

A vulnerability was found in perl-ImageInfo. When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
non-constant time GCM authentication tag comparison (JCE, 8143945)
CVE: CVE-2016-3426
Component: OpenJDK
Severity: Low
Release date: 2016-04-19T00:00:00+00:00

It was discovered that the GCM (Galois/Counter Mode) implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A remote attacker could possibly use this flaw to determine the value of the authentication tag.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart"), as well as all running instances of IBM Java.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Oracle Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
Multiple vulnerabilities fixed in 4.0.10.18, 4.4.15.9 and 4.6.5 versions
CVE: CVE-2016-6624
Component: phpMyAdmin
Release date: 2016-11-25T00:00:00+00:00

An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple overflow issues in protocol decoding
CVE: CVE-2016-7936
Component: tcpdump
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2016-01-01T00:00:00+00:00

Multiple out of bounds read and integer overflow vulnerabilities were found in tcpdump affecting the decoding of various protocols. An attacker could create a crafted pcap file or send specially crafted packets to the network segment where tcpdump is running in live capture mode (without -w) which could cause it to display incorrect data, crash or enter an infinite loop.

Statement: Red Hat Product Security has rated these issues as having Moderate security impact. These issues may be fixed in a future minor release of Red Hat Enterprise Linux 7. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
When invoked with the "-w" option, to write raw packets to a pcap file (for forensic purposes or offline examination), tcpdump does not use the protocol decoding subsystem and is not affected by these flaws. Red Hat Product Security recommends that any unattended uses of tcpdump use this option to ensure uninterrupted packet capture.
tiffcrop readSeparateTilesIntoBuffer() memory corruption
CVE: CVE-2016-5321
Component: libtiff
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2016-06-15T00:00:00+00:00

The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image.


Remediation:
Use After Free Vulnerability in PHP's GC algorithm and unserialize
CVE: CVE-2016-5771
Component: php
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-06-23T00:00:00+00:00

spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
multiple code execution issues fixed in APSB16-15
CVE: CVE-2016-4160
Component: flash-plugin
Severity: Critical
Release date: 2016-05-10T00:00:00+00:00

Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4161, CVE-2016-4162, and CVE-2016-4163.


Remediation:
information leak in extension bindings
CVE: CVE-2016-1698
Component: chromium-browser
Severity: Moderate
Release date: 2016-06-01T00:00:00+00:00

The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate module types, which might allow attackers to load arbitrary modules or obtain sensitive information by leveraging a poisoned definition.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
API and UI actions/URLs not limited to the orgs/locations assigned
CVE: CVE-2016-4475
Component: foreman
CWE: CWE-284
Severity: Moderate
Release date: 2016-06-02T00:00:00+00:00

It was found that the foreman API and UI actions and URLs are not properly limited to the organizations and locations they were assigned to. This could allow an attacker to view and update other organizations and locations in the system that they should not be allowed to.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

To update this system to include these fixes, ensure your system has access to the latest Red Hat packages. For instructions on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Then re-run the installer to complete the upgrade:

# satellite-installer --scenario satellite --upgrade

or

# satellite-installer --scenario capsule --upgrade
multiple code execution issues fixed in APSB16-04
CVE: CVE-2016-0965
Component: flash-plugin
Severity: Critical
Release date: 2016-02-09T00:00:00+00:00

Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
type confusion in v8
CVE: CVE-2016-1677
Component: chromium-browser
Severity: Moderate
Release date: 2016-05-25T00:00:00+00:00

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Use-after-free when applying SVG effects (MFSA 2016-79)
CVE: CVE-2016-5264
Component: Mozilla
Severity: Moderate
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-08-02T00:00:00+00:00

Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
X.509 Certificates Improperly Imported
CVE: CVE-2016-1000030
Component: pidgin
Severity: Low
Release date: 2016-06-21T00:00:00+00:00

Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.


Remediation:
unspecified vulnerability in subcomponent: Server: RBR (CPU October 2016)
CVE: CVE-2016-5634
Component: mysql
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-10-19T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR.


Remediation:
Multiple vulnerabilities
CVE: CVE-2016-8728
Component: mupdf
Release date: 2016-01-01T00:00:00+00:00

An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer. A specially crafted PDF file can cause a out of bounds write resulting in heap metadata and sensitive process memory corruption leading to potential code execution. Victim needs to open the specially crafted file in a vulnerable reader in order to trigger this vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
imagegammacorrect allows arbitrary write access
CVE: CVE-2016-7127
Component: php
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-09-02T00:00:00+00:00

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Too long query name causes segmentation fault in lwresd
CVE: CVE-2016-2775
Component: bind
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-07-18T00:00:00+00:00

It was found that the lightweight resolver protocol implementation in BIND could enter an infinite recursion and crash when asked to resolve a query name which, when combined with a search list entry, exceeds the maximum allowable length. A remote attacker could use this flaw to crash lwresd or named when using the "lwres" statement in named.conf.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted automatically.