huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
EBCDIC overread in X509_NAME_oneline()
CVE: CVE-2016-2176
Component: openssl
CWE: CWE-125
Severity: Low
Release date: 2016-05-03T00:00:00+00:00

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.


Remediation:
TLS SecurityMode.required bypass via StripTLS attack
CVE: CVE-2016-10027
Component: smack
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-11-12T00:00:00+00:00

Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.


Remediation:
Null pointer dereference when unserializing PHP object
CVE: CVE-2016-10162
Component: php
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-01-01T00:00:00+00:00

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
x86 segment base write emulation lacking canonical address checks (XSA-193)
CVE: CVE-2016-9385
Component: xen
Severity: Moderate
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2016-11-22T00:00:00+00:00

The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.


Remediation:
Division by zero in fpAcc function
CVE: CVE-2016-3622
Component: libtiff
CWE: CWE-369
Severity: Low
Release date: 2016-04-07T00:00:00+00:00

The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
H5T_COMPOUND heap buffer overflow
CVE: CVE-2016-4333
Component: hdf5
CWE: CWE-122
Severity: Important
CVSS v3: 8.5/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2016-11-15T00:00:00+00:00

Multiple heap overflows were found in HDF5. These issues could be used to gain code execution in any program that exposes the affected functions to untrusted input. While HDF5 is shipped as a dependency, no Red Hat products are known to expose these issues in any supported use case at this time.


Remediation:
Cross-Site Request Forgery in web UI
CVE: CVE-2016-0720
Component: pcs
CWE: CWE-352
Severity: Moderate
Release date: 2016-02-16T00:00:00+00:00

A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes.

Statement: This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 6, as the web UI functionality is disabled by default in pcsd.

Remediation:
Incomplete handling of LimitRequestFields directive in mod_http2
CVE: CVE-2016-8740
Component: httpd
CWE: CWE-770
Severity: Low
CVSS v3: 5.8/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-12-04T00:00:00+00:00

A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.
As a temporary workaround - HTTP/2 can be disabled by changing
the configuration by removing h2 and h2c from the Protocols
line(s) in the configuration file. 

The resulting line should read:

		Protocols http/1.1
Multiple vulnerabilities fixed in 4.0.10.18, 4.4.15.9 and 4.6.5 versions
CVE: CVE-2016-9852
Component: phpMyAdmin
Release date: 2016-11-25T00:00:00+00:00

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
arbitrary memory read in v8
CVE: CVE-2016-5172
Component: chromium-browser
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2016-09-13T00:00:00+00:00

The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU April 2016)
CVE: CVE-2016-0665
Component: mysql
Severity: Low
Release date: 2016-04-21T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security: Encryption.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MySQL server daemon (mysqld) will be restarted automatically.
multiple font parsing vulnerabilities (Mozilla MFSA 2016-37)
CVE: CVE-2016-1977
Component: graphite2
Severity: Critical
Release date: 2016-03-08T00:00:00+00:00

The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Null pointer dereference in _dwarf_load_section
CVE: CVE-2016-5037
Component: libdwarf
CWE: CWE-476
Severity: Low
Release date: 2016-05-06T00:00:00+00:00

The _dwarf_load_section function in libdwarf before 20160923 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted file.


Remediation:
Thread-unsafe umask modification
CVE: CVE-2016-8605
Component: guile
Severity: Low
CVSS v3: 2.6/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2016-10-10T00:00:00+00:00

A vulnerability was found in guile, in the mkdir procedure's usage of umask(2). Under particular circumstances, an attacker could influence an application written in guile to create directories or files insecurely, potentially exposing them to being read or manipulated by local users.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Heap-based buffer overflow vulnerability in read_n()
CVE: CVE-2016-9917
Component: bluez
CWE: CWE-122
Severity: Low
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2016-11-14T00:00:00+00:00

In BlueZ 5.42, a buffer overflow was observed in "read_n" function in "tools/hcidump.c" source file. This issue can be triggered by processing a corrupted dump file and will result in hcidump crash.


Remediation:
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-4276
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.


Remediation:
assertion failure while handling an unusually-formed DS record response
CVE: CVE-2016-9444
Component: bind
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-01-01T00:00:00+00:00

A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, the BIND daemon (named) will be restarted automatically.
net: pcnet: infinite loop in pcnet_rdra_addr()
CVE: CVE-2016-7909
Component: Qemu
CWE: CWE-835
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2016-09-30T00:00:00+00:00

The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.


Remediation:
DNS rebinding vulnerability when 'DEBUG=True'
CVE: CVE-2016-9014
Component: python-django
Severity: Low
CVSS v3: 7.4/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2016-11-01T00:00:00+00:00

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.


Remediation:
Out-of-bounds read in mat.c
CVE: CVE-2016-10070
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2016-02-14T00:00:00+00:00

Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.


Remediation:
weak permissions on sensitive files
CVE: CVE-2016-2121
Component: redis
CWE: CWE-732
Severity: Low
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2016-11-01T00:00:00+00:00

A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A local, unprivileged user could possibly use this flaw to access unauthorized system information.


Remediation:
wrong error handling for malformed HTTP responses
CVE: CVE-2016-2571
Component: squid
CWE: CWE-228
Severity: Moderate
Release date: 2016-02-24T00:00:00+00:00

It was found that squid did not properly handle errors when failing to parse an HTTP response, possibly leading to an assertion failure. A malicious HTTP server could use this flaw to crash squid using a specially crafted HTTP response.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. 

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the squid service will be restarted automatically.
Addressbar spoofing though the SELECT element (MFSA 2016-52)
CVE: CVE-2016-2822
Component: Mozilla
Severity: Moderate
Release date: 2016-06-08T00:00:00+00:00

Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a persistent menu.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.
Out-of-bounds heap read in _TIFFPrintField (tif_print.c:127)
CVE: CVE-2016-9297
Component: libtiff
CWE: CWE-170
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-11-07T00:00:00+00:00

An out-of-bounds heap read was discovered in libtiff. A crafted file could cause the application to crash or, potentially, disclose process memory.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Kernel panic triggered at BUG_ON in net/core/skbuff.c
CVE: CVE-2016-6162
Component: kernel
Severity: None
CVSS v3: 5.6/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-07-05T00:00:00+00:00

The code in the net/core/skbuff.c in the Linux kernel allows local users to cause a denial of service (a system panic) or possibly have unspecified other impact via certain IPv6 socket operations.


Remediation:
use-after-free in Extensions
CVE: CVE-2016-1648
Component: chromium-browser
Severity: Important
Release date: 2016-03-24T00:00:00+00:00

Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.


Remediation:
Kernel Crash on /dev/fimg2d ioctl command
CVE: CVE-2016-9278
Component: kernel
CWE: CWE-391
Severity: Moderate
CVSS v3: 6.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2016-11-09T00:00:00+00:00

The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kernel panic) via a crafted ioctl command. The Samsung ID is SVE-2016-6736.


Remediation:
Null pointer dereference due to bad form id in HTMLlineproc2body()
CVE: CVE-2016-9628
Component: w3m
CWE: CWE-476
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-11-13T00:00:00+00:00

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.


Remediation:
DoS in MSM QDSP6 audio driver
CVE: CVE-2016-2064
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-08-09T00:00:00+00:00

sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted application that makes an ioctl call specifying many commands.


Remediation:
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-6924
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, and CVE-2016-6922.


Remediation:
scsi: pvscsi: infinite loop when processing IO requests
CVE: CVE-2016-7421
Component: Qemu
CWE: CWE-835
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2016-09-07T00:00:00+00:00

The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size.


Remediation:
bypass authorization by altering VM ID
CVE: CVE-2016-7071
Component: CFME
CWE: CWE-285
Severity: Important
CVSS v3: 9.0/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2016-10-20T00:00:00+00:00

It was found that the CloudForms did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.


Remediation:
Possible symlink attacks due to use of predictable file names
CVE: CVE-2016-9595
Component: katello-debug
CWE: CWE-377
Severity: Moderate
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-12-21T00:00:00+00:00

A flaw was found in katello-debug where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.


Remediation:
For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.3/html/upgrading_and_updating_red_hat_satellite/
Multiple issues disclosed with 0.13.4 update
CVE: CVE-2016-7972
Component: libass
Release date: 2016-10-04T00:00:00+00:00

The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free in gifcolor utility
CVE: CVE-2016-3177
Component: giflib
CWE: CWE-416
Severity: Low
Release date: 2016-03-15T00:00:00+00:00

Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.

Statement: This issue did not affect the versions of giflib as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
DoS parsing SVGs with circular definitions _rsvg_css_normalize_font_size() function
CVE: CVE-2016-4348
Component: librsvg2
CWE: CWE-674
Severity: Moderate
Release date: 2016-04-28T00:00:00+00:00

The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document.


Remediation:
Buffer overflow in parse_line function
CVE: CVE-2016-7837
Component: bluez
CWE: CWE-120
Severity: Low
CVSS v3: 2.3/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-09-10T00:00:00+00:00

Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates.

Remediation:
missing SIZ marker segment XRsiz and YRsiz fields range check
CVE: CVE-2016-8691
Component: jasper
CWE: CWE-369
Severity: Low
CVSS v3: 5.4/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2016-10-15T00:00:00+00:00

The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.


Remediation:
Multiple issues fixed in latest version
CVE: CVE-2016-7564
Component: mujs
Release date: 2016-09-20T00:00:00+00:00

Heap-based buffer overflow in the Fp_toString function in jsfunction.c in Artifex Software MuJS allows attackers to cause a denial of service (crash) via crafted input.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: