huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unspecified vulnerability in subcomponent: Server: MyISAM (CPU April 2016)
CVE: CVE-2016-0641
Component: mysql
Severity: Moderate
Release date: 2016-04-21T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
Use-after-free while manipulating DOM events and audio elements (MFSA 2016-94, MFSA 2016-95)
CVE: CVE-2016-9899
Component: Mozilla
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-12-14T00:00:00+00:00

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
unspecified vulnerability in subcomponent: Server: Connection (CPU July 2016)
CVE: CVE-2016-5443
Component: mysql
Severity: Moderate
CVSS v3: 4.6/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2016-07-20T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.7.12 and earlier allows local users to affect availability via vectors related to Server: Connection.


Remediation:
Stack overflow in gdImageFillToBorder on truecolor images
CVE: CVE-2016-9933
Component: gd
CWE: CWE-20
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-12-08T00:00:00+00:00

An infinite recursion flaw was found in the gdImageFillToBorder() function from the gd library; also used by PHP imagefilltoborder() function, when passing a negative integer as the color parameter, triggering a stack overflow. A remote attacker with ability to force a negative color identifier when calling the function could crash the PHP application, causing a Denial of Service.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
curl_getdate out-of-bounds read
CVE: CVE-2016-8621
Component: curl
CWE: CWE-125
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-11-02T00:00:00+00:00

The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Core Services installation (including all applications and configuration files).
Buffer overflow in MAP coder
CVE: CVE-2016-10054
Component: ImageMagick
CWE: CWE-120
Severity: Moderate
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2016-08-23T00:00:00+00:00

Buffer overflow in the WriteMAPImage function in coders/map.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


Remediation:
Memory safety bugs fixed in Firefox 45.5 (MFSA 2016-90)
CVE: CVE-2016-5290
Component: Mozilla
Severity: Critical
CVSS v3: 9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-11-16T00:00:00+00:00

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
Insufficient shell characters filtering
CVE: CVE-2016-3714
Component: ImageMagick
CWE: CWE-20
Severity: Important
CVSS v3: 8.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-05-03T00:00:00+00:00

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.


Remediation:
Details can be found under the resolve tab at https://access.redhat.com/security/vulnerabilities/2296071

Red Hat Enterprise Linux 6 and 7
================================

As a workaround the /etc/ImageMagick/policy.xml file can be edited to disable processing of MVG, HTTPS, HTTP, URL, FTP, EPHEMERAL, MSL, LABEL, TEXT, SHOW, WIN and PLT commands within image files, simply add the following lines:
<policy domain="coder" rights="none" pattern="EPHEMERAL" />
<policy domain="coder" rights="none" pattern="HTTPS" />
<policy domain="coder" rights="none" pattern="HTTP" />
<policy domain="coder" rights="none" pattern="URL" />
<policy domain="coder" rights="none" pattern="FTP" />
<policy domain="coder" rights="none" pattern="MVG" />
<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="TEXT" />
<policy domain="coder" rights="none" pattern="LABEL" />
<policy domain="coder" rights="none" pattern="SHOW" />
<policy domain="coder" rights="none" pattern="WIN" />
<policy domain="coder" rights="none" pattern="PLT" />
<policy domain="path" rights="none" pattern="@*" />

within the policy map stanza:
<policymap>
...
</policymap>


Red Hat Enterprise Linux 5
==========================

In the following folders:
/usr/lib64/ImageMagick-6.2.8/modules-Q16/coders/ (64bit package)
or
/usr/lib/ImageMagick-6.2.8/modules-Q16/coders/ (32bit package)

Rename the following files:
* mvg.so to mvg.so.bak
* msl.so to msl.so.bak
* label.so to label.so.bak
Miscellaneous memory safety hazards (rv:46.0 / rv:45.1) (MFSA 2016-39)
CVE: CVE-2016-2806
Component: Mozilla
Severity: Critical
Release date: 2016-04-26T00:00:00+00:00

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
vfs: ioctl: double fetch leading to heap overflow
CVE: CVE-2016-6516
Component: kernel
Severity: Important
CVSS v3: 8.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-07-31T00:00:00+00:00

Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability.


Remediation:
out-of-bounds access in libxslt
CVE: CVE-2016-1683
Component: chromium-browser
Severity: Moderate
Release date: 2016-05-25T00:00:00+00:00

numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
multiple code execution issues fixed in APSB16-08
CVE: CVE-2016-0991
Component: flash-plugin
Severity: Critical
Release date: 2016-03-10T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Multiple XSS vulnerabilities (PMASA-2016-3)
CVE: CVE-2016-2040
Component: phpMyAdmin
Release date: 2016-01-28T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Command Injection via bash escape characters
CVE: CVE-2016-10541
Component: nodejs-shell-quote
CWE: CWE-77
Severity: Important
CVSS v3: 8.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-06-21T00:00:00+00:00

The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.


Remediation:
Use after free in xsltDocumentFunctionLoadDocument
CVE: CVE-2016-1841
Component: libxslt
CWE: CWE-416
Severity: Moderate
CVSS v3: 8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-01-01T00:00:00+00:00

libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.


Remediation:
possible input validation circumvention in Active Model
CVE: CVE-2016-0753
Component: rubygem-activerecord
CWE: CWE-20
Severity: Moderate
Release date: 2016-01-25T00:00:00+00:00

A flaw was found in the way the Active Model based models processed attributes. An attacker with the ability to pass arbitrary attributes to models could possibly use this flaw to bypass input validation.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Do not allow arbitrary attributes to be passed to models. In Rails with Strong Parameters, make sure to not call permit! method, which bypasses strong parameters protections. Outside of rails, use whitelisting to filter only allowed attributes before passing them to models.
Multiple security issues
CVE: CVE-2016-8699
Component: potrace
Release date: 2016-08-18T00:00:00+00:00

Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usb: hcd-ehci: memory leak in ehci_process_itd
CVE: CVE-2016-7995
Component: Qemu
CWE: CWE-772
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2016-09-26T00:00:00+00:00

Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.


Remediation:
NULL pointer dereference in input decoding
CVE: CVE-2016-9572
Component: openjpeg
CWE: CWE-476
Severity: Low
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-10-28T00:00:00+00:00

A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.


Remediation:
weak authentication secret in Pipe implementation on Windows (Networking, 8145446)
CVE: CVE-2016-3485
Component: OpenJDK
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2016-07-19T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.


Remediation:
out of bounds read in fill_xrgb32_lerp_opaque_spans
CVE: CVE-2016-3190
Component: cairo
CWE: CWE-787
Severity: Moderate
Release date: 2016-03-10T00:00:00+00:00

The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Heap use-after-free in nsINode::ReplaceOrInsertBefore
CVE: CVE-2016-9067
Component: firefox
CWE: CWE-416
Severity: Important
CVSS v3: 8.3/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2016-11-15T00:00:00+00:00

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
Write access violation with '<button type=radio>'
CVE: CVE-2016-9437
Component: w3m
CWE: CWE-20
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-08-17T00:00:00+00:00

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) and possibly memory corruption via a crafted HTML page.


Remediation:
Non-privileged session can escape to the parent session in chroot
CVE: CVE-2016-2781
Component: coreutils
CWE: CWE-270
Severity: Moderate
CVSS v3: 8.5/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2016-02-28T00:00:00+00:00

It was found that chroot was vulnerable to TIOCSTI ioctl attacks, allowing the executed program to push characters to its TTY's input buffer. While being executed as a non-privileged user, a specially crafted program could force its parent TTY to enter commands, interpreted by the shell when chroot exits.

Statement: This issue affects the versions of coreutils as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Heap-based buffer overflow in update_entry()
CVE: CVE-2016-5044
Component: libdwarf
CWE: CWE-122
Severity: Low
Release date: 2016-05-04T00:00:00+00:00

The WRITE_UNALIGNED function in dwarf_elf_access.c in libdwarf before 20160923 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted DWARF section.


Remediation:
redirect() doesn't filter "\r\n" which allows for CRLF attack
CVE: CVE-2016-9964
Component: python-bottle
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2016-12-08T00:00:00+00:00

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Attack on interface selection
CVE: CVE-2016-7429
Component: ntp
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-11-21T00:00:00+00:00

A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the ntpd daemon will restart automatically.
If you are going to configure your OS to disable source address checks, also configure your firewall configuration to control what interfaces can receive packets from what networks.
incorrect check for SubjectAltNames during CA ACL check
CVE: CVE-2016-5414
Component: freeipa
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2016-08-31T00:00:00+00:00

FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.


Remediation:
heap buffer overflow in escapeshell functions
CVE: CVE-2016-1904
Component: php
CWE: CWE-122
Severity: Moderate
Release date: 2016-01-14T00:00:00+00:00

Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.


Remediation:
unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)
CVE: CVE-2016-0616
Component: mysql
Severity: Moderate
Release date: 2016-01-01T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
Integer overflow when receiving messages bigger than 4GB
CVE: CVE-2016-2851
Component: libotr
Release date: 2016-03-09T00:00:00+00:00

Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
XSS in Apache CXF FormattedServiceListWriter
CVE: CVE-2016-6812
Component: apache-cxf
CWE: CWE-79
Severity: Moderate
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2016-12-19T00:00:00+00:00

A vulnerability was found in FormattedServiceListWriter in Apache CXF HTTP transport module that could allow an attacker to inject unexpected matrix parameters into the request URL. On a successful injection these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).