huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
incorrect handling of popular pages
CVE: CVE-2013-6650
Component: v8
CWE: CWE-480
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of "popular pages."


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Subscription Manageemnt.
Details on how to use Red Hat Subscription Management are available at
https://access.redhat.com/articles/433903.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Heap-based buffer overflows by expanding a specially-crafted archive
CVE: CVE-2013-4397
Component: libtar
CWE: CWE-122
Severity: Moderate
Release date: 2013-10-09T00:00:00+00:00

Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
bypass of intended rules via chunked requests
CVE: CVE-2013-5705
Component: mod_security
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.


Remediation:
mount folder existence information disclosure
CVE: CVE-2013-0157
Component: util-linux
Severity: Low
Release date: 2013-01-05T00:00:00+00:00

(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Monitor server user credentials exposure in automated requests to get update information
CVE: CVE-2013-4114
Component: nagstamon
Release date: 2013-07-11T00:00:00+00:00

The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vmxnet3: bounds checking buffer overrun
CVE: CVE-2013-4544
Component: Qemu
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices.  NOTE: some of these details are obtained from third party information.


Remediation:
unspecified DoS related to Server Partition (CPU July 2013)
CVE: CVE-2013-3794
Component: mysql
Severity: Low
Release date: 2013-07-17T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.30 and earlier and 5.6.10 allows remote authenticated users to affect availability via unknown vectors related to Server Partition.

Statement: Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
unintended API access due to incorrect permissions checks
CVE: CVE-2013-4401
Component: libvirt
Severity: Important
Release date: 2013-10-21T00:00:00+00:00

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML.  NOTE: some of these details are obtained from third party information.

Statement: Not vulnerable.

This issue did not affect the versions of libvirt package as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Arbitrary file upload via deserialization
CVE: CVE-2013-2185
Component: Tomcat/JBossWeb
CWE: CWE-626
Severity: Important
Release date: 2013-09-03T00:00:00+00:00

It was possible for an attacker, using complex and limited conditions, to upload a malicious JSP to a Tomcat server and then trigger the execution of that JSP.

Statement: This issue did not affect the versions of Tomcat as shipped with Red Hat Enterprise Linux 5, 6 and 7; and Red Hat JBoss Web Server 1 and 2.

This issue did not affect the versions of JBoss Web as shipped with Red Hat JBoss BRMS 5; Red Hat JBoss Data Grid 6; Red Hat JBoss Data Virtualization 6; Red Hat JBoss Enterprise Application Platform 4 and 5; Red Hat JBoss Fuse Service Works 6; Red Hat JBoss Operations Network 3; Red Hat JBoss Portal Platform 5; Red Hat JBoss SOA Platform 4 and 5; and Red Hat JBoss Web Platform 5.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.

The JBoss server process must be restarted for the update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up all
applications deployed on Red Hat JBoss Portal, along with all customized
configuration files, and any databases and database settings.

Note that it is recommended to halt the Red Hat JBoss Portal server by
stopping the JBoss Application Server process before installing this
update, and then after installing the update, restart the Red Hat JBoss
Portal server by starting the JBoss Application Server process.
Multiple integer overflows leading to heap-based buffer-overflows
CVE: CVE-2013-1984
Component: libXi
CWE: CWE-122
Severity: Moderate
Release date: 2013-05-23T00:00:00+00:00

Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XGetDeviceControl, (2) XGetFeedbackControl, (3) XGetDeviceDontPropagateList, (4) XGetDeviceMotionEvents, (5) XIGetProperty, (6) XIGetSelectedEvents, (7) XGetDeviceProperties, and (8) XListInputDevices functions.

Statement: This issue affects the libXi package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
unspecified DoS related to Stored Procedure subcomponent (CPU Jan 2014)
CVE: CVE-2013-5882
Component: mysql
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote authenticated users to affect availability via unknown vectors related to Stored Procedures.

Statement: Not Vulnerable. This issue does not affect the version of mysql55-mysql package as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of mysql as shipped with Red Hat Enterprise Linux 6.

Remediation:
multiple denial of service flaws
CVE: CVE-2013-1438
Component: LibRaw
Severity: Low
Release date: 2013-08-28T00:00:00+00:00

Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Unix sockets use after free - peer_wait_queue prematurely freed
CVE: CVE-2013-7446
Component: kernel
CWE: CWE-362
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of Unix sockets.  A server polling for client-socket data could put the peer socket on a wait list; the peer socket could then close the connection, making the reference on the wait list no longer valid.  This could lead to bypassing the permissions on a Unix socket and packets being injected into the stream, and could also panic the machine (denial of service).

Statement: This issue does not affect Linux kernels as shipped with Red Hat Enterprise linux 5,7, MRG-2 and realtime kernels.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 6 and may be addressed in a future update.

This has been rated as having Moderate security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

Remediation:
unspecified unauthenticated DoS vulnerability related to Server Locking (CPU Jan 2013)
CVE: CVE-2013-0383
Component: mysql
Severity: Moderate
Release date: 2013-01-15T00:00:00+00:00

Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
unauthorized hosts and services displayed in servicegroup view
CVE: CVE-2013-2214
Component: nagios
Severity: Moderate
Release date: 2013-05-06T00:00:00+00:00

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview, (2) summary, or (3) grid style in status.cgi.  NOTE: this behavior is by design in most 3.x versions, but the upstream vendor "decided to change it for Nagios 4" and 3.5.1.

Statement: This is not a flaw; Nagios upstream implemented this as a feature, as documented in their changelog.

Remediation:
Bypass of XrayWrappers using XBL Scopes (MFSA 2013-70)
CVE: CVE-2013-1711
Component: Mozilla
Severity: Moderate
Release date: 2013-08-06T00:00:00+00:00

The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
staging: ozwpan: buffer overflow in oz_cdev_write
CVE: CVE-2013-4513
Component: Kernel
Severity: Low
Release date: 2013-11-22T00:00:00+00:00

Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

Remediation:
DoS via specially-crafted stun messages
CVE: CVE-2013-6484
Component: pidgin
CWE: CWE-190
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
NULL pointer dereference leads to crash and bypass of screen lock
CVE: CVE-2013-4143
Component: xlockmore
Release date: 2013-07-14T00:00:00+00:00

The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
improper random number generation on certain Intel platforms with OpenSSL 1.x
CVE: CVE-2013-7295
Component: tor
Release date: 2013-12-23T00:00:00+00:00

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
xen: Hypervisor crash due to missing exception recovery on XSETBV
CVE: CVE-2013-2078
Component: kernel
Severity: Important
Release date: 2013-06-03T00:00:00+00:00

Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.

Remediation:
arbitrary file access when downloads enabled for users with commit access
CVE: CVE-2013-6892
Component: websvn
Release date: 2013-01-01T00:00:00+00:00

WebSVN 2.3.3 allows remote authenticated users to read arbitrary files via a symlink attack in a commit.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple unspecified JavaFX vulnerabilities fixed in 7u21 (JavaFX)
CVE: CVE-2013-2428
Component: JDK
Severity: Critical
Release date: 2013-04-16T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX, a different vulnerability than CVE-2013-0402, CVE-2013-2414, and CVE-2013-2427.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
SSL protocol downgrade
CVE: CVE-2013-1654
Component: Puppet
Severity: Low
Release date: 2013-03-12T00:00:00+00:00

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
remote code execution via locally saved SQL dump file multiple extensions (PMASA-2013-3)
CVE: CVE-2013-3239
Component: phpMyAdmin
Release date: 2013-04-24T00:00:00+00:00

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple vulnerabilities corrected in 6.29 and 7.24 (SA-CORE-2013-003)
CVE: CVE-2013-6386
Component: drupal
Release date: 2013-11-20T00:00:00+00:00

Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
DoS via large passwords
CVE: CVE-2013-1443
Component: python-django
Severity: Moderate
Release date: 2013-09-15T00:00:00+00:00

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.


Remediation:
Not removing bad metadata and using it in next run
CVE: CVE-2013-1910
Component: yum
CWE: CWE-347
Severity: Moderate
Release date: 2013-03-27T00:00:00+00:00

yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.

Statement: Not vulnerable. This issue did not affect the versions of yum as shipped with Red Hat Enterprise Linux 5 and 6, as yum in those products did not (try to) use filelists metadata yet.

Remediation:
multiple code execution flaws (APSB13-02)
CVE: CVE-2013-0602
Component: acroread
Severity: Critical
Release date: 2013-01-08T00:00:00+00:00

Use-after-free vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Certain invalid UTF-8 sequences accepted as valid
CVE: CVE-2013-0252
Component: boost
Severity: Low
Release date: 2013-02-01T00:00:00+00:00

boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.

Statement: Not vulnerable. This issue did not affect the versions of boost as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
css_sanitization: XSS vulnerability in sanitize_css
CVE: CVE-2013-1855
Component: rubygem-actionpack
CWE: CWE-79
Severity: Moderate
Release date: 2013-03-18T00:00:00+00:00

A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct XSS attacks against users of an application using Action Pack.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Event manipulation in plugin handler to bypass same-origin policy (MFSA 2013-10)
CVE: CVE-2013-0747
Component: Mozilla
Severity: Moderate
Release date: 2013-01-08T00:00:00+00:00

The gPluginHandler.handleEvent function in the plugin handler in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly enforce the Same Origin Policy, which allows remote attackers to conduct clickjacking attacks via crafted JavaScript code that listens for a mutation event.

Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation: