huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
out-of-bounds write with malicious font in graphite2 (MFSA 2016-38)
CVE: CVE-2016-1969
Component: mozilla
CWE: CWE-787
Severity: Moderate
Release date: 2016-03-08T00:00:00+00:00

The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted Graphite smart font.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3)
CVE: CVE-2016-7444
Component: gnutls
CWE: CWE-295
Severity: Low
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2016-09-02T00:00:00+00:00

A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances.


Remediation:
Response splitting vulnerability using Unicode characters
CVE: CVE-2016-2216
Component: nodejs
CWE: CWE-113
Severity: Moderate
Release date: 2016-02-09T00:00:00+00:00

The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP header, as demonstrated by %c4%8d%c4%8a.


Remediation:
XSS due to unquoted attributes that need escaping in legacy browsers
CVE: CVE-2016-9909
Component: python-html5lib
CVSS v3: 6.0/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2016-01-01T00:00:00+00:00

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Null pointer dereference in create_fullest_file_path()
CVE: CVE-2016-5029
Component: libdwarf
CWE: CWE-476
Severity: Low
Release date: 2016-05-22T00:00:00+00:00

The create_fullest_file_path function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted dwarf file.


Remediation:
Unhandled POSTs can write to the filesystem by default
CVE: CVE-2016-6255
Component: libupnp
Release date: 2016-02-23T00:00:00+00:00

Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: nfnetlink: correctly validate length of batch messages
CVE: CVE-2016-7917
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 5.1/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2016-02-02T00:00:00+00:00

The nfnetlink_rcv_batch() function in 'net/netfilter/nfnetlink.c' in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG-2 as code with the flaw is not present in the products listed.

Remediation:
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD disclosed in log file
CVE: CVE-2016-6310
Component: ovirt-engine
CWE: CWE-532
Severity: Moderate
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-08-03T00:00:00+00:00

oVirt Engine discloses the ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0.


Remediation:
Agent certificate containing private key is stored in world-readable file
CVE: CVE-2016-3112
Component: pulp
CWE: CWE-732
Severity: Moderate
Release date: 2016-04-13T00:00:00+00:00

It was found that the private key for the agent certificate was contained in a world-readable file. A local user could possibly use this flaw to gain access to the private key information in the file.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied and that the Satellite is updated to the most recent 6.1.x release. 

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en/red-hat-satellite/6.2/single/installation-guide#upgrading_satellite_server_and_capsule_server
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-4287
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Integer overflow in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors.


Remediation:
DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data
CVE: CVE-2016-1000338
Component: bouncycastle
CWE: CWE-325
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2016-10-15T00:00:00+00:00

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

Statement: This issue affects the versions of bouncycastle as shipped with Red Hat Subscription Asset Manager 1.x. Red Hat Product Security has rated this issue as having a security impact of Moderate. No update is planned for this product at this time. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/upgrading_and_updating_red_hat_satellite/
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are located in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).
Multiple security issues
CVE: CVE-2016-10202
Component: zoneminder
Release date: 2016-01-01T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the path info to index.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
display: vmsvga: out-of-bounds read in vmsvga_fifo_read_raw() routine
CVE: CVE-2016-4454
Component: Qemu
CWE: CWE-125
Severity: Moderate
Release date: 2016-05-30T00:00:00+00:00

Quick Emulator(Qemu) built with the VMware-SVGA "chipset" emulation support is vulnerable to an information disclosure issue. It could occur while processing VGA commands via its FIFO buffer. A privileged user inside guest could use this flaw to leak host memory bytes or crash the Qemu process resulting in DoS.


Remediation:
Multiple security vulnerabilities
CVE: CVE-2016-9266
Component: ming
Release date: 2016-11-07T00:00:00+00:00

listmp3.c in libming 0.4.7 allows remote attackers to unspecified impact via a crafted mp3 file, which triggers an invalid left shift.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
android downloaded file path restriction bypass
CVE: CVE-2016-1656
Component: chromium-browser
Severity: Moderate
Release date: 2016-04-13T00:00:00+00:00

The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.


Remediation:
Heap buffer overflow in FLIC decoder
CVE: CVE-2016-9636
Component: gstreamer-plugins-good
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-11-21T00:00:00+00:00

Multiple flaws were discovered in GStreamer's FLC/FLI/FLX media file format decoding plug-in. A remote attacker could use these flaws to cause an application using GStreamer to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


Remediation:
This mitigation is only required if vulnerable gstreamer-plugins-good and/or gstreamer1-plugins-good packages are installed.

For RHEL 7,

sudo rm /usr/lib*/gstreamer-1.0/libgstflxdec.so
sudo rm /usr/lib*/gstreamer-0.10/libgstflxdec.so

For RHEL 5 and RHEL 6,

sudo rm /usr/lib*/gstreamer-0.10/libgstflxdec.so

Please note that this mitigation deletes the vulnerable FLI/FLC/FLX animation demuxer file(s), which removes the functionality to play FLI/FLC/FLX animation files.
Insecure usage of perl exec()
CVE: CVE-2016-10081
Component: shutter
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-12-29T00:00:00+00:00

/usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Run a plugin" action.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Little entropy used for hash initialization
CVE: CVE-2016-5300
Component: expat
CWE: CWE-331
Severity: Moderate
Release date: 2016-06-04T00:00:00+00:00

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.


Remediation:
Heap-buffer overflow in IsPixelGray in pixel-accessor.h (Incomplete fix for CVE-2016-9556)
CVE: CVE-2016-9773
Component: ImageMagick
CWE: CWE-122
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-12-01T00:00:00+00:00

Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9556.


Remediation:
multiple code execution issues fixed in APSB16-18
CVE: CVE-2016-4141
Component: flash-plugin
Severity: Critical
Release date: 2016-06-14T00:00:00+00:00

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.


Remediation:
Pocket extension does not validate the origin of events (MFSA 2016-94, MFSA 2016-95)
CVE: CVE-2016-9902
Component: Mozilla
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2016-12-14T00:00:00+00:00

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to take effect.
ui spoofing
CVE: CVE-2016-5188
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2016-10-12T00:00:00+00:00

Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Use-after-free when using multiple WebRTC data channels (MFSA 2016-25)
CVE: CVE-2016-1962
Component: Mozilla
CWE: CWE-416
Severity: Critical
Release date: 2016-03-08T00:00:00+00:00

Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Multiple vulnerabilities fixed in 7.52
CVE: CVE-2016-9451
Component: drupal
Release date: 2016-11-16T00:00:00+00:00

Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple code execution issues fixed in APSB16-37
CVE: CVE-2016-7859
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-11-08T00:00:00+00:00

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.


Remediation:
null pointer dereference in kadmin
CVE: CVE-2016-3119
Component: krb5
CWE: CWE-476
Severity: Low
Release date: 2016-03-14T00:00:00+00:00

A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a null pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, running Kerberos services (krb5kdc, kadmin, and kprop) will be restarted automatically.
NULL pointer dereference in archive_wstring_append_from_mbs function
CVE: CVE-2016-10209
Component: libarchive
CWE: CWE-476
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-12-12T00:00:00+00:00

The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted archive file.


Remediation:
various fixes from internal audits
CVE: CVE-2016-5167
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-08-31T00:00:00+00:00

Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Multiple vulnerabilities fixed in 4.0.10.18, 4.4.15.9 and 4.6.5 versions
CVE: CVE-2016-9847
Component: phpMyAdmin
Release date: 2016-11-25T00:00:00+00:00

An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
MITM due to resources download over HTTP
CVE: CVE-2016-10659
Component: poco
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-01-01T00:00:00+00:00

poco - The POCO libraries, downloads source file resources used for compilation over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
missing jas_matrix_create() parameter checks
CVE: CVE-2016-8885
Component: jasper
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-15T00:00:00+00:00

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.


Remediation:
buffer over-read in l2cap_dump()
CVE: CVE-2016-9797
Component: bluez
CWE: CWE-125
Severity: Low
CVSS v3: 2.5/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-12-03T00:00:00+00:00

In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.


Remediation:
vfs: missing detection of hardlinks in vfs_rename() on overlayfs
CVE: CVE-2016-6198
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-07-11T00:00:00+00:00

A flaw was found that the vfs_rename() function did not detect hard links on overlayfs. A local, unprivileged user could use the rename syscall on overlayfs on top of xfs to crash the system.

Statement: This issue is not present in the Linux kernel packages as shipped with Red Hat Enterprise Linux versions 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-6931
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, and CVE-2016-6932.


Remediation:
Out of bounds read in viff file handling
CVE: CVE-2016-10065
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2016-02-14T00:00:00+00:00

The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.


Remediation:
assertion failure while handling certain queries using the nxdomain-redirect feature
CVE: CVE-2016-9778
Component: bind
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-01-01T00:00:00+00:00

An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A vulnerable server could be intentionally stopped by an attacker if it was using a configuration that met the criteria for the vulnerability and if the attacker could cause it to accept a query that possessed the required attributes. Please note: This vulnerability affects the "nxdomain-redirect" feature, which is one of two methods of handling NXDOMAIN redirection, and is only available in certain versions of BIND. Redirection using zones of type "redirect" is not affected by this vulnerability. Affects BIND 9.9.8-S1 -> 9.9.8-S3, 9.9.9-S1 -> 9.9.9-S6, 9.11.0-9.11.0-P1.


Remediation: