huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Memory leak in the ReadJNGImage function
CVE: CVE-2017-8350
Component: ImageMagick
CWE: CWE-460
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-04-26T00:00:00+00:00

In ImageMagick 7.0.5-5, the ReadJNGImage function in png.c allows attackers to cause a denial of service (memory leak) via a crafted file.


Remediation:
use after free in v8
CVE: CVE-2017-5098
Component: chromium-browser
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-07-25T00:00:00+00:00

A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
incorrect stack manipulation in webassembly
CVE: CVE-2017-5132
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-10-17T00:00:00+00:00

Inappropriate implementation in V8 in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka incorrect WebAssembly stack manipulation.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
out of bounds heap read in bfd_mach_o_i386_canonicalize_one_reloc function
CVE: CVE-2017-12452
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-07-21T00:00:00+00:00

The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.


Remediation:
divide-by-zero error in wav_w64_read_fmt_chunk()
CVE: CVE-2017-16942
Component: libsndfile
CWE: CWE-369
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-11-25T00:00:00+00:00

In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero error exists in the function wav_w64_read_fmt_chunk() in wav_w64.c, which may lead to DoS when playing a crafted audio file.


Remediation:
CORS not properly applied
CVE: CVE-2017-8700
Component: ASP.NET
Severity: Moderate
CVSS v3: 8.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2017-11-14T22:00:00+00:00

A flaw was found in dotNET where the CORS attribute is not properly enforced or checked. An attacker could leverage this for possible remote execution.


Remediation:
stack-based buffer overflow in ucnv_u8.cpp:ucnv_UTF8FromUTF8 can lead to denial of service
CVE: CVE-2017-17484
Component: icu
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2017-11-21T00:00:00+00:00

The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International Components for Unicode (ICU) for C/C++ through 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted string, as demonstrated by ZNC.

Statement: This issue did not affect the versions of icu as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
Proxy is sharing cookies among all the clients
CVE: CVE-2017-2589
Component: hawtio
CWE: CWE-285
Severity: Important
CVSS v3: 8.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Release date: 2017-07-28T00:00:00+00:00

It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

You can find installation instructions in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).
NULL Pointer Dereference in id3_ucs4_length function in ucs4.c
CVE: CVE-2017-11550
Component: libid3tag
CWE: CWE-119
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-08-07T00:00:00+00:00

The id3_ucs4_length function in ucs4.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service (NULL Pointer Dereference and application crash) via a crafted mp3 file.


Remediation:
Buffer Overflow in ntpq when fetching reslist from a malicious ntpd
CVE: CVE-2017-6460
Component: ntp
CWE: CWE-121
Severity: Moderate
CVSS v3: 7.2/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-03-21T00:00:00+00:00

A vulnerability was found in NTP, in the ntpq program. A malicious server could send a specially crafted response which would cause a stack buffer overflow, leading to a crash or potential code execution.


Remediation:
Floating point exception in the ImageStream class
CVE: CVE-2017-14617
Component: poppler
CWE: CWE-682
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-09-19T00:00:00+00:00

In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.


Remediation:
Reinstallation of the group key in the 4-way handshake
CVE: CVE-2017-13078
Component: wpa_supplicant
CWE: CWE-323
Severity: Important
CVSS v3: 8.0/CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2017-10-16T00:00:00+00:00

A new exploitation technique called key reinstallation attacks (KRACK) affecting WPA2 has been discovered. A remote attacker within Wi-Fi range could exploit this attack to decrypt Wi-Fi traffic or possibly inject forged Wi-Fi packets by reinstalling a previously used group key (GTK) during a 4-way handshake.

Statement: This issue affects the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
CVE: CVE-2017-1002022
Component: CVE-2017-1002022
Release date: 2017-09-14T00:00:00+00:00

Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out-of-bounds write in rdp_recv_tpkt_pdu
CVE: CVE-2017-2835
Component: freerdp
CWE: CWE-129
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-07-24T00:00:00+00:00

An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle to trigger this vulnerability.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Domain spoofing with combination of Canadian Syllabics and other unicode blocks (MFSA 2017-16)
CVE: CVE-2017-7764
Component: Mozilla
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2017-06-14T00:00:00+00:00

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts.". This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Memory leak in the function WriteCALSImage
CVE: CVE-2017-12669
Component: ImageMagick
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-07-17T00:00:00+00:00

ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.


Remediation:
Bypass $cfg['Servers'][$i]['AllowNoPassword']
CVE: CVE-2017-18264
Component: phpMyAdmin
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2017-03-28T00:00:00+00:00

An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused by $cfg['Servers'][$i]['AllowNoPassword'] = false are bypassed under certain PHP versions (e.g., version 5). This can allow the login of users who have no password set even if the administrator has set $cfg['Servers'][$i]['AllowNoPassword'] to false (which is also the default). This occurs because some implementations of the PHP substr function return false when given '' as the first argument.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Set a password for all users.

Affected versions:

Version 4.0 prior to 4.0.10.20
Version 4.4 (no longer supported)
Version 4.6 (no longer supported)
Version 4.7.0-beta1 and 4.7.0-rc1

Upstream patches:

https://github.com/phpmyadmin/phpmyadmin
https://github.com/phpmyadmin/phpmyadmin/commit/b6ca92cc75c8a16001425be7881e73430bcc35b8
https://github.com/phpmyadmin/phpmyadmin/commit/7232271a379396ca1d4b083af051262057003c41
Multiple security issues
CVE: CVE-2017-5923
Component: yara
Release date: 2017-01-01T00:00:00+00:00

libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
information leak in the DHCPv6 relay code
CVE: CVE-2017-14494
Component: dnsmasq
CWE: CWE-125
Severity: Important
CVSS v3: 6.4/CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2017-10-02T00:00:00+00:00

An information leak was found in dnsmasq in the DHCPv6 relay code. An attacker on the local network could send crafted DHCPv6 packets to dnsmasq causing it to forward the contents of process memory, potentially leaking sensitive data.

Statement: Red Hat OpenStack Platform includes the dnsmasq-utils RPM which does not contain this flaw's affected code-paths; Red Hat OpenStack Platform is therefore listed as not affected.

However, because all versions of Red Hat OpenStack Platform are based on Red Hat Enterprise Linux, all Red Hat OpenStack Platform users should absolutely upgrade the dnsmasq RPM from Red Hat Enterprise Linux as a matter of urgency using standard update mechanisms (such as 'yum update' or 'openstack overcloud update').

Remediation:
Out-of-bounds write in data2vp_wimax()
CVE: CVE-2017-10984
Component: freeradius
CWE: CWE-787
Severity: Important
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-07-17T00:00:00+00:00

An out-of-bounds write flaw was found in the way FreeRADIUS server handled certain attributes in request packets. A remote attacker could use this flaw to crash the FreeRADIUS server or to execute arbitrary code in the context of the FreeRADIUS server process by sending a specially crafted request packet.


Remediation:
Heap-buffer-overflow in __hash_open
CVE: CVE-2017-11696
Component: nss
CWE: CWE-122
Severity: Low
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-08-09T00:00:00+00:00

Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.

Statement: NSS uses a local DBM database to store configuration and security (Certificates etc) information. These database files are created by NSS during startup and is used during its normal operation. These files are not read/retrieved from an external source. This flaw is related to specially-crafted NSS DBM files. So the only way to exploit this flaw is to replace the local NSS db with these files which require local user access on the machine running NSS. Therefore Red Hat Product Security does not consider this as a security flaw.

Remediation:
universal xss in chrome://downloads
CVE: CVE-2017-5020
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2017-01-25T00:00:00+00:00

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to require a user gesture for powerful download operations, which allowed a remote attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
HTTP response splitting in WEBrick
CVE: CVE-2017-17742
Component: ruby
CWE: CWE-113
Severity: Moderate
CVSS v3: 4.6/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Release date: 2017-01-01T00:00:00+00:00

It was found that WEBrick did not sanitize headers sent back to clients, resulting in a response-splitting vulnerability. An attacker, able to control the server's headers, could force WEBrick into injecting additional headers to a client.

Statement: This issue affects the versions of ruby as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

This issue affects the versions of ruby as shipped with Red Hat Subscription Asset Manager 1. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
The server can manually sanitize possibly untrusted headers prior to inserting them in the reply.
Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 (MFSA 2017-16)
CVE: CVE-2017-5470
Component: Mozilla
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2017-06-14T00:00:00+00:00

Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
integer overflow in xls_appendSST function could result in remote code execution
CVE: CVE-2017-12110
Component: libxls
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2017-11-15T00:00:00+00:00

An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4.A specially crafted XLS file can cause memory corruption resulting in remote code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference in the AnnotRichMedia::Configuration::Configuration
CVE: CVE-2017-14928
Component: poppler
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-09-08T00:00:00+00:00

In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document.


Remediation:
unsafe use of temporary directory
CVE: CVE-2017-0367
Component: mediawiki
CWE: CWE-377
Severity: Low
CVSS v3: 4.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2017-03-26T00:00:00+00:00

Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure.


Remediation:
Memory Leak in ReadPWPImage in coders/pwp.c
CVE: CVE-2017-18008
Component: ImageMagick
CWE: CWE-400
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-12-27T00:00:00+00:00

In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadPWPImage in coders/pwp.c.


Remediation:
Multiple security issues fixed in OpenVPN 2.4.3 and 2.3.17
CVE: CVE-2017-7508
Component: openvpn
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2017-06-21T00:00:00+00:00

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

Statement: This issue does not affect Red Hat Enterprise Linux 5, 6 and 7 as OpenVPN is not included in any of Red Hat's supported products.

Remediation:
Multiple vulnerabilities fixed in 1.9.2 version
CVE: CVE-2017-9146
Component: ytnef
Release date: 2017-02-23T00:00:00+00:00

The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted tnef file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Illegal address access in in Exiv2::FileIo::path[abi:cxx11]()
CVE: CVE-2017-12956
Component: exiv2
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-08-17T00:00:00+00:00

There is an illegal address access in Exiv2::FileIo::path[abi:cxx11]() in basicio.cpp of libexiv2 in Exiv2 0.26 that will lead to remote denial of service.


Remediation:
Off-by-one error in the DrawImage function
CVE: CVE-2017-14314
Component: GraphicsMagick
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-08-28T00:00:00+00:00

Off-by-one error in the DrawImage function in magick/render.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (DrawDashPolygon heap-based buffer over-read and application crash) via a crafted file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple vulnerabilities
CVE: CVE-2017-11546
Component: TiMidity++
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2017-07-31T00:00:00+00:00

The insert_note_steps function in readmidi.c in TiMidity++ 2.14.0 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mid file. NOTE: a crash might be relevant when using the --background option.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Reinstallation of the integrity group key in the group key handshake
CVE: CVE-2017-13081
Component: wpa_supplicant
CWE: CWE-323
Severity: Important
CVSS v3: 8.0/CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2017-10-16T00:00:00+00:00

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

Statement: This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 5, 6, and 7, as CONFIG_IEEE80211W was not enabled.

Remediation: