huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
asm.js JIT-spray bypass of ASLR and DEP (MFSA 2017-06)
CVE: CVE-2017-5400
Component: Mozilla
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-03-07T00:00:00+00:00

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
Out-of-bounds read while dumping the debug information from a corrupt binary
CVE: CVE-2017-8398
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-22T00:00:00+00:00

dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.


Remediation:
multiple out of bounds writes in chunkdemuxer
CVE: CVE-2017-5050
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-03-09T00:00:00+00:00

An integer overflow in FFmpeg in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory write via a crafted video file, related to ChunkDemuxer.


Remediation:
Float out of range issue in tif_dirread.c
CVE: CVE-2017-7597
Component: libtiff
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-09T00:00:00+00:00

tif_dirread.c in LibTIFF 4.0.7 has an "outside the range of representable values of type float" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted image.


Remediation:
double free in csnmp_read_table function in snmp.c
CVE: CVE-2017-16820
Component: collectd
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2017-11-14T00:00:00+00:00

A double-free vulnerability was found in the csnmp_read_table function in the SNMP plugin of collectd. A network-based attacker could exploit this by sending malformed data, causing collectd to crash or possibly other impact.


Remediation:
Before applying this update, ensure all previously released errata relevant
to your system have been applied. 

Red Hat OpenStack Platform 10 runs on Red Hat Enterprise Linux 7.5.

The Red Hat OpenStack Platform 10 Release Notes contain the following:
* An explanation of the way in which the provided components interact to
form a working cloud computing environment.
* Technology Previews, Recommended Practices, and Known Issues.
* The channels required for Red Hat OpenStack Platform 10, including which
channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/documentation/en/red-hat-openstack-platform/

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html
WBXML dissector infinite loop (wnpa-sec-2017-13)
CVE: CVE-2017-7702
Component: wireshark
Severity: Moderate
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-04-12T00:00:00+00:00

In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation.


Remediation:
Infoleak/use-after-free in __oom_reap_task_mm function in mm/oom_kill.c
CVE: CVE-2017-18202
Component: kernel
CWE: CWE-119
Severity: Important
CVSS v3: 6.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2017-01-01T00:00:00+00:00

The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel, before 4.14.4, mishandles gather operations. This allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Buffer overflow in mp_override_legacy_irq()
CVE: CVE-2017-11473
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 6.7/CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-07-18T00:00:00+00:00

Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 4.12.2 allows local users to gain privileges via a crafted ACPI table.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates of the Red Hat products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This attack requires 

- An attacker to be able to write to the ACPI tables ( local, privileged operation and non generalized attacks)
- The ability for the attacker to reboot the system  ( local, privileged operation )
- The ACPI table changes to persist through reboots  ( not common on cloud/serverless platforms )
- This modification to the table alone is able to possibly corrupt memory, but the corruption will not be enough alone, the corrupted affected memory will be overwritten with valid acpi struct data which also has to corrupt the memory in which a way the flaw can create abuse (HARD).
- The attacker will find it significantly difficult to abuse this a flaw in early-boot as injecting code/controlled execution at this point would require privileges.  If an attacker had this specific privilege, there are easier ways to gain privilege escalation.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2017-1000429
Component: CVE-2017-1000429
Release date: 2017-01-01T00:00:00+00:00

rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2017-1000079
Component: CVE-2017-1000079
Release date: 2017-08-09T00:00:00+00:00

Linux foundation ONOS 1.9.0 is vulnerable to a DoS.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory leak in the WriteJP2Image() function
CVE: CVE-2017-11536
Component: ImageMagick
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-07-16T00:00:00+00:00

When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Memory Leak in the WriteJP2Image() function in coders/jp2.c.


Remediation:
Infinite loop in the processing of https requests
CVE: CVE-2017-6056
Component: tomcat
CWE: CWE-835
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-01-01T00:00:00+00:00

It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in denial of service via an infinite loop.

Statement: This issue was made easier to exploit, causing a denial of service when the patch for CVE-2016-6816 was present and the patch that corrected this flaw was not.  The issue was not classified as a security flaw upstream.  It was corrected in products like Red Hat Enterprise Linux 6 and 7 and JBoss Enterprise Web Server 3 prior to the fix for CVE-2016-6816 being applied.  This was not the case for JBoss Enterprise Application Server 6.  As a result, only EAP 6.4.13 is vulnerable to this issue and 6.4.14 corrects it.  For further information, refer to https://access.redhat.com/articles/2991951

Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).
Arbitrary code execution due to incomplete sandbox protection (SECURITY-551)
CVE: CVE-2017-1000096
Component: jenkins-plugin-workflow-cps
CWE: CWE-184
Severity: Important
CVSS v3: 4.7/CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Release date: 2017-07-10T00:00:00+00:00

The jenkins-plugin-script-security has incomplete sandbox protection which allows attackers to execute arbitrary code via constructors, instance variable initializers, and instance initializers in Pipeline scripts. Exploitation of this requires the attacker to have permission to configure Pipelines in Jenkins or be a trusted committers to repositories containing Jenkinsfiles and for that Jenkins instance to be hosting other projects as well that the attacker should not have access to.

Statement: This issue affects the versions of jenkins-plugin-workflow-cps  as shipped with Red Hat OpenShift Enterprise 3. However, this flaw is of low impact under the supported scenarios in OpenShift Enterprise 3. A future update may address this issue.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For OpenShift Container Platform 3.5, see the following documentation, which will be updated shortly for release 3.5.5.31, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.5/release_notes/ocp_3_5_release_notes.html

For OpenShift Container Platform 3.4, see the following documentation, which will be updated shortly for release 3.4.1.44, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.4/release_notes/ocp_3_4_release_notes.html

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258.
memory leak vulnerability in ReadXWDImage function in coders/xwd.c
CVE: CVE-2017-11166
Component: ImageMagick
CWE: CWE-772
Severity: Low
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2017-05-04T00:00:00+00:00

The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD file.


Remediation:
Volume security can be sidestepped with innocent emptyDir and subpath
CVE: CVE-2017-1002101
Component: kubernetes
Severity: Important
CVSS v3: 7.7/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-01-01T00:00:00+00:00

It was found that volume security can be sidestepped with innocent emptyDir and subpath. This could give an attacker with access to a pod full control over the node host by gaining access to docker socket.

Statement: This flaw allows a pod to mount any part of the host filesystem. The pod will run with the security contraints placed on the user but could read anything with o=rx mode and appropriate SELinux label.

Remediation:
Infinite loop related to QPDFObjectHandle::parseInternal
CVE: CVE-2017-9209
Component: qpdf
CWE: CWE-835
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-05-21T00:00:00+00:00

libqpdf.a in QPDF 6.0.0 allows remote attackers to cause a denial of service (infinite recursion and stack consumption) via a crafted PDF document, related to QPDFObjectHandle::parseInternal, aka qpdf-infiniteloop2.


Remediation:
Potential use-after-free during DOM manipulations (MFSA 2017-02)
CVE: CVE-2017-5380
Component: Mozilla
Severity: Moderate
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-01-24T00:00:00+00:00

A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
XSS in self-service UI snapshot feature
CVE: CVE-2017-15125
Component: cloudforms
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Release date: 2017-12-21T00:00:00+00:00

A flaw was found in CloudForms in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.

Statement: This issue affects the versions of cfme as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.
CVE: CVE-2017-1000215
Component: CVE-2017-1000215
Release date: 2017-04-20T00:00:00+00:00

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Integer overflow in mysqli_api.c:mysqli_real_escape_string()
CVE: CVE-2017-9120
Component: php
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2017-05-09T00:00:00+00:00

PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.

Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 6 and 7 (versions 5.3.3 and 5.4.16, respectively).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
uninitialized use in skia
CVE: CVE-2017-5103
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2017-07-25T00:00:00+00:00

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
denial of service condition due to a double free when SSH connection fails
CVE: CVE-2017-18594
Component: nmap
CWE: CWE-400
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-01-01T00:00:00+00:00

nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.

Statement: Red Hat Enterprise Linux 8 is shipped with a vulnerable version of nmap sources, however, the libssh2 module is explicitly excluded from compilation, and is thus not affected. A future update may fix the source.

Red Hat Enterprise Linux 7 and older are shipped with nmap-6.40 and older, which do not contain the libssh2 module.

Remediation:
Multiple vulnerabilities
CVE: CVE-2017-9989
Component: ming
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-06-23T00:00:00+00:00

util/outputtxt.c in libming 0.4.8 mishandles memory allocation. A crafted input will lead to a remote denial of service (NULL pointer dereference) attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Buffer overflow in the flac_buffer_copy function
CVE: CVE-2017-8361
Component: libsndfile
CWE: CWE-120
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-29T00:00:00+00:00

The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file.


Remediation:
heap-buffer-overflow in Exiv2::IptcData::printStructure in src/iptc.cpp
CVE: CVE-2017-17724
Component: exiv2
CWE: CWE-125
Severity: Low
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2017-12-10T00:00:00+00:00

An integer underflow, leading to heap-based out-of-bound read, was found in the way Exiv2 library prints IPTC Photo Metadata embedded in an image. By persuading a victim to open a crafted image, a remote attacker could crash the application or possibly retrieve a portion of memory.

Statement: This issue did not affect the versions of Exiv2 as shipped with Red Hat Enterprise Linux 6 and 7 as they did not include support for printing IPTC Photo Metadata.

Remediation:
information disclosure in blink
CVE: CVE-2017-5046
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2017-03-09T00:00:00+00:00

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
SSL_VERIFYSTATUS ignored
CVE: CVE-2017-2629
Component: curl
CWE: CWE-295
Severity: Moderate
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2017-02-22T00:00:00+00:00

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).


Remediation:
Unvalidated extra length in ProcEstablishConnection
CVE: CVE-2017-12176
Component: xorg-x11-server
CWE: CWE-391
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-10-10T00:00:00+00:00

xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


Remediation:
CPU consumption via crafted file
CVE: CVE-2017-14108
Component: gedit
CWE: CWE-400
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-09-02T00:00:00+00:00

libgedit.a in GNOME gedit through 3.22.1 allows remote attackers to cause a denial of service (CPU consumption) via a file that begins with many '\0' characters.


Remediation: