huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unspecified remote exploit (released with VulnDisco Pack Professional 9.17)
CVE: CVE-2012-0882
Component: mysql
Severity: Important
Release date: 2012-02-09T00:00:00+00:00

Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17.  NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.  NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.

Statement: We do not currently plan to fix this issue due to the lack of further
information about the flaw and its impact. If more information becomes
available at a future date, we may revisit the issue.

Remediation:
core allows unprivileged users to insert data into Jenkins master
CVE: CVE-2012-4438
Component: Jenkins
Severity: Moderate
Release date: 2012-09-17T00:00:00+00:00

Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.


Remediation:
ipvs: information leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
CVE: CVE-2012-6540
Component: Kernel
Severity: Low
Release date: 2012-08-15T00:00:00+00:00

The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

Remediation:
Access bypass - content administration
CVE: CVE-2012-2153
Component: 7
Release date: 2012-05-02T00:00:00+00:00

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Unspecified vulnerability allows local users to affect availability via unknown vectors
CVE: CVE-2012-0494
Component: mysql
Severity: Low
Release date: 2012-01-18T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows local users to affect availability via unknown vectors.

Statement: Not vulnerable.  According to the upstream report, this flaw affects MySQL 5.5.x, which is not provided in Red Hat Enterprise Linux 4, 5, or 6.

Remediation:
Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2012-105)
CVE: CVE-2012-4212
Component: Mozilla
CWE: CWE-119
Severity: Critical
Release date: 2012-11-20T00:00:00+00:00

Use-after-free vulnerability in the XPCWrappedNative::Mark function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
multiple security fixes in 2.2.2, 2.1.5, 2.0.8, 1.9.17
CVE: CVE-2012-1155
Component: moodle
Release date: 2012-03-12T00:00:00+00:00

Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
lock directories created mode 0777 allow for FS-based authentication challenge bypass
CVE: CVE-2012-3492
Component: condor
Severity: Moderate
Release date: 2012-09-19T00:00:00+00:00

The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.


Remediation:
All users of the Grid capabilities of Red Hat Enterprise MRG 2 are advised
to upgrade to these updated packages, which resolve the issues and add the
enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes. Condor
and Cumin must be restarted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
All users of the Grid capabilities of Red Hat Enterprise MRG 2 are advised
to upgrade to these updated packages, which resolve the issues and add the
enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes. Condor
and Cumin must be restarted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
pulp admin password logged in plaintext in world-readable katello/production.log
CVE: CVE-2012-3538
Component: katello
Severity: Moderate
Release date: 2012-12-04T00:00:00+00:00

Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
buffer overflow flaw in apache_request_headers() in PHP 5.4.x
CVE: CVE-2012-2329
Component: php
CWE: CWE-119
Severity: Important
Release date: 2012-05-08T00:00:00+00:00

Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.

Statement: Not vulnerable. This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 4, 5, or 6.  This flaw only affects PHP 5.4.0 through 5.4.2.

Remediation:
not closing incomplete connections exhausts file descriptors, leading to DoS
CVE: CVE-2012-2145
Component: qpid-cpp
Severity: Moderate
Release date: 2012-04-24T00:00:00+00:00

Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
arbitrary code execution without authentication in scriptfu network server
CVE: CVE-2012-4245
Component: gimp
Severity: None
Release date: 2012-08-16T00:00:00+00:00

The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command.

Statement: Red Hat does not consider this to be a security flaw.  The GIMP scriptfu server works as intended and should not be enabled in production environments as it was not designed to have any kind of security protection.

Remediation:
Content Security Policy inline-script bypass (MFSA 2012-36)
CVE: CVE-2012-1944
Component: Mozilla
Severity: Moderate
Release date: 2012-06-05T00:00:00+00:00

The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not block inline event handlers, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
SQL injection flaw
CVE: CVE-2012-2684
Component: cumin
Severity: Moderate
Release date: 2012-09-19T00:00:00+00:00

Multiple SQL injection vulnerabilities in the get_sample_filters_by_signature function in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to execute arbitrary SQL commands via the (1) agent or (2) object id.


Remediation:
All users of the Grid capabilities of Red Hat Enterprise MRG 2 are advised
to upgrade to these updated packages, which resolve the issues and add the
enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes. Condor
and Cumin must be restarted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
All users of the Grid capabilities of Red Hat Enterprise MRG 2 are advised
to upgrade to these updated packages, which resolve the issues and add the
enhancements noted in the Red Hat Enterprise MRG 2 Technical Notes. Condor
and Cumin must be restarted for this update to take effect.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
xen: several HVM operations do not validate the range of their inputs
CVE: CVE-2012-5511
Component: kernel
Severity: Moderate
Release date: 2012-12-03T00:00:00+00:00

Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.

Remediation:
Miscellaneous memory safety hazards (rv:10.0.11) (MFSA 2012-91)
CVE: CVE-2012-5842
Component: Mozilla
Severity: Critical
Release date: 2012-11-20T00:00:00+00:00

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
CVE: CVE-2012-5638
Component: sanlock world writable /var/log/sanlock.log
Severity: Low
Release date: 2012-08-22T00:00:00+00:00

The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations.


Remediation:
All users of Red Hat Storage are advised to upgrade to these updated
packages.

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
multiple code-execution flaws (APSB12-22)
CVE: CVE-2012-5268
Component: flash-plugin
Severity: Critical
Release date: 2012-10-08T00:00:00+00:00

Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than other Flash Player memory corruption CVEs listed in APSB12-22.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Use-after-free, buffer overflow, and out of bounds read issues found using Address Sanitizer (MFSA 2012-85)
CVE: CVE-2012-4183
Component: Mozilla
CWE: CWE-125
Severity: Critical
Release date: 2012-10-09T00:00:00+00:00

Use-after-free vulnerability in the DOMSVGTests::GetRequiredFeatures function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
snmpd crashes/hangs when AgentX subagent times-out
CVE: CVE-2012-6151
Component: net-snmp
Severity: Moderate
Release date: 2012-09-05T00:00:00+00:00

Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
multiple code-execution flaws (APSB12-22)
CVE: CVE-2012-5287
Component: flash-plugin
Severity: Critical
Release date: 2012-10-08T00:00:00+00:00

Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
multiple double free() flaws
CVE: CVE-2012-6063
Component: libssh
Release date: 2012-11-20T00:00:00+00:00

Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow vulnerability
CVE: CVE-2012-1175
Component: gnash
Release date: 2012-03-11T00:00:00+00:00

Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SWF file, which triggers a heap-based buffer overflow.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Stored XSS via a File::link to a non-existing image
CVE: CVE-2012-4377
Component: mediawiki
Release date: 2012-08-30T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Read from freed memory and double free by processing failed DNS request
CVE: CVE-2012-3518
Component: tor
Release date: 2012-08-19T00:00:00+00:00

The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple code execution flaw (APSB12-16)
CVE: CVE-2012-1525
Component: acroread
Severity: Critical
Release date: 2012-08-14T00:00:00+00:00

Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors.


Remediation:
Use-after-free, buffer overflow, and memory corruption issues found using Address Sanitizer (MFSA 2012-106)
CVE: CVE-2012-5835
Component: Mozilla
CWE: CWE-119
Severity: Critical
Release date: 2012-11-20T00:00:00+00:00

Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (invalid write operation) via crafted data.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258