huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
SLAB freelist randomization produces duplicate entries
CVE: CVE-2017-5546
Component: kernel
CWE: CWE-391
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-01-11T00:00:00+00:00

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.


Remediation:
Use-after-free in the af_packet.c
CVE: CVE-2017-15649
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-09-20T00:00:00+00:00

It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free bug.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as a code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future updates for the respective releases may address this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
type confusion in v8
CVE: CVE-2017-5116
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-09-05T00:00:00+00:00

Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Location bar spoofing with unicode characters (MFSA 2017-02)
CVE: CVE-2017-5383
Component: Mozilla
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2017-01-24T00:00:00+00:00

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c
CVE: CVE-2017-15126
Component: kernel
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-12-05T00:00:00+00:00

A flaw was found in the Linux kernel's handling of fork failure when dealing with event messages in the userfaultfd code. Failure to fork correctly can create a fork event that will be removed from an already freed list of events.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat
Enterprise Linux 7, realtime, MRG-2 prior to version kernel-3.10.0-781.

The kernel-alt package already as shipped contains this fix.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Sensitive information included in legacy notification exception contexts
CVE: CVE-2017-7214
Component: openstack-nova
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.9/CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Release date: 2017-03-21T00:00:00+00:00

An information exposure issue was discovered in OpenStack Compute's exception_wrapper.py. Legacy notification exception contexts appearing in ERROR-level logs could include sensitive information such as account passwords and authorization tokens.


Remediation:
Heap-based buffer over-read in the WritePSImage() function
CVE: CVE-2017-11535
Component: ImageMagick
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-07-16T00:00:00+00:00

When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a heap-based buffer over-read in the WritePSImage() function in coders/ps.c.


Remediation:
Server: InnoDB unspecified vulnerability (CPU Jan 2017)
CVE: CVE-2017-3257
Component: mysql
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-01-18T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS v3.0 Base Score 6.5 (Availability impacts).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
Unsafe methods in the default whitelist (SECURITY-538)
CVE: CVE-2017-1000095
Component: jenkins-plugin-script-security
CWE: CWE-184
Severity: Important
CVSS v3: 4.7/CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Release date: 2017-07-10T00:00:00+00:00

The jenkins-plugin-script-security improperly whitelisted "DefaultGroovyMethods.putAt(Object, String, Object)" and "DefaultGroovyMethods.getAt(Object, String)" which allows attackers to bypass many restrictions and potentially trigger builds or access data they should not have access to. Exploitation of this requires the attacker to have access to the Jenkins instance, and for that Jenkins instance to be hosting other projects as well that the attacker should not have access to.

Statement: This issue affects the versions of jenkins-plugin-script-security as shipped with OpenShift Enterprise 3. However, this flaw is of low impact under the supported scenarios in OpenShift Enterprise 3. A future update may address this issue.

Remediation:
Before applying this update, ensure all previously released errata relevant to your system have been applied.

For instructions on new installations, see the following documentation:

https://docs.openshift.com/container-platform/3.6/install_config/install/planning.html

For instructions on how to properly upgrade existing clusters to OpenShift
Container Platform 3.6, see the following documentation:

https://docs.openshift.com/container-platform/3.6/install_config/upgrading/index.html
cryptographic cache-based side channel in the RSA implementation
CVE: CVE-2017-14737
Component: botan
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2017-08-16T00:00:00+00:00

A cryptographic cache-based side channel in the RSA implementation in Botan before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to recover information about RSA secret keys, as demonstrated by CacheD. This occurs because an array is indexed with bits derived from a secret key.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap-based buffer over-read in paste_tokens function in asm/preproc.c
CVE: CVE-2017-17818
Component: nasm
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-12-21T00:00:00+00:00

In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_tokens in asm/preproc.c.


Remediation:
Malicious containers can delete any file from the node
CVE: CVE-2017-1002102
Component: kubernetes
CWE: CWE-59
Severity: Moderate
CVSS v3: 7.2/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2017-01-01T00:00:00+00:00

This vulnerability allows containers using a secret, configMap, projected, or downwardAPI volume to trigger deletion of arbitrary files and directories on the nodes where they are running. An attacker could use this flaw to delete arbitrary file or directories on node host.


Remediation:
insecure error log file handling in mysqld_safe, incomplete CVE-2016-6664 fix (CPU Jan 2017)
CVE: CVE-2017-3312
Component: mysql
Severity: Moderate
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-01-17T00:00:00+00:00

Multiple flaws were found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use these flaws to escalate their privileges to root.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
BGP dissector infinite loop (wnpa-sec-2017-16)
CVE: CVE-2017-7701
Component: wireshark
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-04-12T00:00:00+00:00

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type.


Remediation:
Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c
CVE: CVE-2017-18201
Component: libcdio
CWE: CWE-119
Severity: Low
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-01-01T00:00:00+00:00

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.


Remediation:
Regular expression Denial of Service
CVE: CVE-2017-16136
Component: nodejs-method-override
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2017-09-27T00:00:00+00:00

method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.


Remediation:
Directory traversal in the Zip::File component
CVE: CVE-2017-5946
Component: rubygem-rubyzip
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-02-04T00:00:00+00:00

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.

Statement: This issue affects the versions of rubygem-rubyzip as shipped with Red Hat Quick Cloud Installer. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Unauthenticated remote code execution (SECURITY-429)
CVE: CVE-2017-1000353
Component: jenkins
CWE: CWE-502
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-04-26T00:00:00+00:00

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.


Remediation:
Heap-based buffer overflow in enhance.c
CVE: CVE-2017-12876
Component: ImageMagick
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-08-10T00:00:00+00:00

Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.


Remediation:
Modbus dissector crash (wnpa-sec-2017-40)
CVE: CVE-2017-13764
Component: wireshark
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-08-29T00:00:00+00:00

In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/packet-mbtcp.c by adding length validation.


Remediation:
information disclosure in xss auditor
CVE: CVE-2017-5045
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2017-03-09T00:00:00+00:00

XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
synchronization problem in the MutexGuard object
CVE: CVE-2017-20004
Component: rust
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2017-04-29T00:00:00+00:00

In the standard library in Rust before 1.19.0, there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types, allowing for memory safety issues through race conditions.


Remediation:
XSS in discovery rule filter autocomplete functionality
CVE: CVE-2017-12175
Component: 6
CWE: CWE-79
Severity: Moderate
CVSS v3: 3.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2017-10-05T00:00:00+00:00

Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.


Remediation:
For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/
use after free in chrome apps
CVE: CVE-2017-5100
Component: chromium-browser
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-07-25T00:00:00+00:00

A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Unsafe YAML deserialization
CVE: CVE-2017-2295
Component: puppet
CWE: CWE-502
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-05-11T00:00:00+00:00

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.


Remediation:
For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.3/html/upgrading_and_updating_red_hat_satellite/
Information leak due to fencepost error in pipe_advance()
CVE: CVE-2017-5550
Component: kernel
Severity: Moderate
CVSS v3: 3.4/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2017-01-15T00:00:00+00:00

Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic circumstances by reading from a pipe after an incorrect buffer-release decision.


Remediation:
Out-of-bounds read in the flac_buffer_copy function
CVE: CVE-2017-8362
Component: libsndfile
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-29T00:00:00+00:00

The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file.


Remediation:
Buffer over-read in print-decnet.c:decnet_print() in DECnet parser
CVE: CVE-2017-12899
Component: tcpdump
CWE: CWE-125
Severity: Low
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2017-09-13T00:00:00+00:00

The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().


Remediation:
buffer over-read in finish_nested_data function
CVE: CVE-2017-12933
Component: php
CWE: CWE-125
Severity: Low
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-02-16T00:00:00+00:00

The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Multiple security vulnerabilities
CVE: CVE-2017-7994
Component: podofo
Release date: 2017-04-22T00:00:00+00:00

The function TextExtractor::ExtractText in TextExtractor.cpp:77 in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
C API unspecified vulnerability (CPU Jul 2017)
CVE: CVE-2017-3650
Component: mysql
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2017-07-19T00:00:00+00:00

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: C API). Supported versions that are affected are 5.7.18 and earlier. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
CVE: CVE-2017-1000492
Component: CVE-2017-1000492
Release date: 2017-01-01T00:00:00+00:00

Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2017-1000168
Component: CVE-2017-1000168
Release date: 2017-01-01T00:00:00+00:00

sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keys

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: