huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ECDSA signature flaw
CVE: CVE-2013-2944
Component: strongswan
Release date: 2013-04-30T00:00:00+00:00

strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
security releases 1.22.1, 1.21.4 and 1.19.10
CVE: CVE-2013-6454
Component: mediawiki
Release date: 2013-01-01T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incomplete fix for CVE-2013-2096
CVE: CVE-2013-4469
Component: Nova
Severity: Moderate
Release date: 2013-10-31T00:00:00+00:00

OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.

Statement: The Red Hat Security Response Team has rated this issue as having moderate security impact. This issue only affects systems that implemented the fix for  CVE-2013-2096 (Bz963462) which fails to completely address the problem. For  additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
insufficient access checks in MacOS code (Swing, 8021275, 8021282)
CVE: CVE-2013-5805
Component: OpenJDK
Severity: Critical
Release date: 2013-10-15T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing, a different vulnerability than CVE-2013-5806.

Statement: Not vulnerable. This issue did not affect the versions of Java as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Uses poor PRNG in nonce
CVE: CVE-2013-4347
Component: python-oauth2
CWE: CWE-338
Severity: Moderate
Release date: 2013-04-24T00:00:00+00:00

It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Full upgrade instructions are available in the Satellite 6.1 Installation
Guide:
https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/Installation_Guide/chap-Upgrading_Red_Hat_Satellite_and_Capsule_Server.html

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
DoS (crash) via LOCK requests against an activity URL
CVE: CVE-2013-1846
Component: (mod_dav_svn)
Severity: Low
Release date: 2013-04-04T00:00:00+00:00

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Use-after-free in ListenerManager (MFSA 2013-17)
CVE: CVE-2013-0754
Component: Mozilla
CWE: CWE-416
Severity: Critical
Release date: 2013-01-08T00:00:00+00:00

Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors involving the triggering of garbage collection after memory allocation for listener objects.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
synchronous io guest DoS
CVE: CVE-2013-0241
Component: qxl
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex.  NOTE: some of these details are obtained from third party information.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
multiple code execution flaws (APSB13-02)
CVE: CVE-2013-0611
Component: acroread
Severity: Critical
Release date: 2013-01-08T00:00:00+00:00

Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0614, and CVE-2013-0618.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
cross-site scripting flaw in the web interface
CVE: CVE-2013-6395
Component: ganglia
Release date: 2013-11-22T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in header.php in Ganglia Web 3.5.8 and 3.5.10 allows remote attackers to inject arbitrary web script or HTML via the host_regex parameter to the default URI, which is processed by get_context.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Cinder Denial of Service using XML entities
CVE: CVE-2013-4202
Component: OpenStack
Severity: Moderate
Release date: 2013-08-08T00:00:00+00:00

The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
insufficient MoveDisk target domain permission checks
CVE: CVE-2013-0168
Component: rhev-m
Severity: Moderate
Release date: 2013-02-04T00:00:00+00:00

The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Virtualization/3.1/html/Installation_Guide/chap-Upgrading_to_Red_Hat_Enterprise_Virtualization_3.1.html
DoS and signature bypass in the processing of HMAC output length
CVE: CVE-2013-2155
Component: xml-security-c
Release date: 2013-06-18T00:00:00+00:00

Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified vulnerability fixed in 7u25 (Deployment)
CVE: CVE-2013-3744
Component: JDK
Severity: Moderate
Release date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2400.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
DoS (infinite loop) in the HTTP dissector (wnpa-sec-2013-39)
CVE: CVE-2013-4081
Component: wireshark
CWE: CWE-835
Severity: Low
Release date: 2013-06-07T00:00:00+00:00

The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
out-of-bounds memory read flaws in version 1.5.1
CVE: CVE-2013-6053
Component: openjpeg
Severity: Moderate
Release date: 2013-12-04T00:00:00+00:00

OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.

Statement: Not Vulnerable. This issue does not affect the version of openjpeg as shipped with Red Hat Enterprise Linux 6.

Remediation:
possible security bypass on admin page (5.0.13)
CVE: CVE-2013-6403
Component: owncloud
Release date: 2013-11-08T00:00:00+00:00

The admin page in ownCloud before 5.0.13 allows remote attackers to bypass intended access restrictions via unspecified vectors, related to MariaDB.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
CVE: CVE-2013-2440
Component: JDK
Severity: Critical
Release date: 2013-04-16T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2435.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
hash collision DoS
CVE: CVE-2013-6371
Component: json-c
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Multiple stack overflow flaws when parsing XML files
CVE: CVE-2013-2298
Component: boinc-client
Release date: 2013-04-28T00:00:00+00:00

Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Live migration can leak root disk into ephemeral storage
CVE: CVE-2013-7130
Component: nova
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
(substantially) limited leak of unauthorized information
CVE: CVE-2013-4209
Component: ABRT
CWE: CWE-200
Severity: Low
Release date: 2013-09-06T00:00:00+00:00

Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums.

Statement: Not vulnerable. This issue did not affect the versions of abrt as shipped with Red Hat Enterprise Linux 6.

Remediation:
predictable /tmp in set-proxy connection hook
CVE: CVE-2013-0163
Component: cartridge
CWE: CWE-377
Severity: Low
Release date: 2013-01-01T00:00:00+00:00

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS

Statement: This issue affects the versions of the haproxy cartridge as shipped with Red Hat OpenShift Enterprise 1 and 2. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Additionally OpenShift uses a per user poly-instantiated /tmp directory which makes exploitation of this issue very difficult.

Remediation:
call_console_drivers() function log prefix stripping DoS
CVE: CVE-2013-1772
Component: kernel
Severity: Low
Release date: 2013-02-22T00:00:00+00:00

The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.

Statement: This issue did not affect the versions of kernel package as shipped with Red Hat Enterprise Linux 5 and 6. Future kernel updates for Red Hat Enterprise MRG 2 may address this flaw.

Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
NULL pointer dereference in libavcodec/error_resilience.c
CVE: CVE-2013-0860
Component: qffmpeg
CWE: CWE-476
Severity: Low
Release date: 2013-01-11T00:00:00+00:00

The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.

Statement: The Red Hat Security Response Team has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
DoS in API OAuth authentication
CVE: CVE-2013-4120
Component: katello
Severity: Low
Release date: 2013-01-01T00:00:00+00:00

Katello has a Denial of Service vulnerability in API OAuth authentication


Remediation:
saltstack multiple flaws
CVE: CVE-2013-4435
Component: salt
Release date: 2013-09-19T00:00:00+00:00

Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler
CVE: CVE-2013-6408
Component: Solr
Severity: Moderate
Release date: 2013-05-31T00:00:00+00:00

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Data Grid installation.
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing installation of Red Hat JBoss Web Framework Kit.

The JBoss server process must be restarted for this update to take effect.
upstream 2.3.9, 2.4.6, 2.5.2 security fixes
CVE: CVE-2013-5674
Component: moodle
Release date: 2013-09-09T00:00:00+00:00

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple Information Disclosure flaws due to unsafe path traversal
CVE: CVE-2013-3827
Component: JSF2
CWE: CWE-22
Severity: Important
Release date: 2013-10-17T00:00:00+00:00

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Data Grid installation.