huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
privilege escalation via shared class cache
CVE: CVE-2014-3065
Component: JDK
Severity: Moderate
Release date: 2014-11-10T00:00:00+00:00

Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
security flaws fixed in the 4.0.1 release
CVE: CVE-2014-9038
Component: wordpress
Release date: 2014-11-20T00:00:00+00:00

wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in WebAudio
CVE: CVE-2014-7925
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

Use-after-free vulnerability in the WebAudio implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an audio-rendering thread in which AudioNode data is improperly maintained.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
XSS flaw due to improper parsing of Special:PasswordReset
CVE: CVE-2014-3966
Component: mediawiki
Release date: 2014-05-29T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
denial of service via shutdown port
CVE: CVE-2014-0219
Component: Karaf
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.


Remediation:
remote code execution flaw via dynamic scripting
CVE: CVE-2014-3120
Component: elasticsearch
CWE: CWE-749
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to _search.

Statement: On Subscription Asset Manager (SAM) 1, the elasticsearch service is only bound to the loopback interface by default. To exploit this issue on a SAM 1 system, an attacker must have local access to the system. On Red Hat JBoss Fuse and Red Hat JBoss A-MQ, the elasticsearch service is only started if the insight-elasticsearch feature is installed. This feature is not installed by default.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. After updating, run the
"katello-configure" command to apply the needed configuration changes.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
To mitigate this issue, follow the instructions at
https://access.redhat.com/solutions/1191453

For more information, refer to https://access.redhat.com/solutions/1189133
To mitigate this issue, follow the instructions at
https://access.redhat.com/solutions/1191453

For more information, refer to https://access.redhat.com/solutions/1189133
multiple vulnerabilities
CVE: CVE-2014-9487
Component: mediawiki
Release date: 2014-12-17T00:00:00+00:00

The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.  NOTE: Related to CVE-2014-2053.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Bignum squaring may produce incorrect results
CVE: CVE-2014-3570
Component: openssl
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2014-01-01T00:00:00+00:00

It was found that OpenSSL's BigNumber Squaring implementation could produce incorrect results under certain special conditions. This flaw could possibly affect certain OpenSSL library functionality, such as RSA blinding. Note that this issue occurred rarely and with a low probability, and there is currently no known way of exploiting it.

Statement: This issue affects the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Low security impact and does not plan to address this flaw for the above components in any future security updates.

This issue affects the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing Red Hat JBoss Enterprise Application Platform installation and
deployed applications.
Before applying the update, back up your existing Red Hat JBoss Web Server
installation (including all applications and configuration files).

The References section of this erratum contains a download link (you must
log in to download the update).

Refer to the Red Hat JBoss Enterprise Web Server 2.1.1 Release Notes for a
list of non security related fixes.
Frame metadissector crash (wnpa-sec-2014-07)
CVE: CVE-2014-4020
Component: wireshark
Severity: Moderate
Release date: 2014-04-17T00:00:00+00:00

The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Remediation:
arbitrary code execution and denial of service
CVE: CVE-2014-1388
Component: webkitgtk
Severity: Moderate
Release date: 2014-11-08T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.6 and 7.x before 7.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in HT6367.


Remediation:
unspecified vulnerability related to Thread Pooling DoS (CPU Jan 2014)
CVE: CVE-2014-0433
Component: mysql
Severity: Moderate
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.13 and earlier allows remote attackers to affect availability via unknown vectors related to Thread Pooling.

Statement: Not Vulnerable. This issue does not affect the version of mysql55-mysql package as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of mysql as shipped with Red Hat Enterprise Linux 6.

Remediation:
stack-based buffer overflow in datetime input/output
CVE: CVE-2014-0063
Component: postgresql
CWE: CWE-121
Severity: Important
Release date: 2014-02-17T00:00:00+00:00

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
These updated packages upgrade PostgreSQL to version 9.2.7, which fixes
these issues as well as several non-security issues. Refer to the
PostgreSQL Release Notes for a full list of changes:

http://www.postgresql.org/docs/9.2/static/release-9-2-7.html

This update also fixes several bugs and adds various enhancements.
Documentation for these changes will be available shortly from the
Technical Notes document linked to in the References section.

All users of Red Hat CloudForms 3.0 are advised to upgrade to these updated
packages, which correct these issues and add these enhancements.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
remote code execution and SQL injection
CVE: CVE-2014-5261
Component: cacti
Release date: 2014-06-28T00:00:00+00:00

The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple code execution flaws (APSB14-24)
CVE: CVE-2014-0576
Component: flash-plugin
Severity: Critical
Release date: 2014-11-11T00:00:00+00:00

Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK & Compiler before 15.0.0.356 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0581, CVE-2014-8440, and CVE-2014-8441.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
heap overflow via incorrect isolateCount
CVE: CVE-2014-8146
Component: icu
CWE: CWE-787
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via crafted text.


Remediation:
upstream 2.6.2, 2.5.5, and 2.4.9 fixes
CVE: CVE-2014-0126
Component: moodle
Release date: 2014-03-17T00:00:00+00:00

Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that import an IMS Enterprise file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cross-site scripting (XSS) flaw in rrdPlugin
CVE: CVE-2014-4165
Component: ntop
Release date: 2014-06-10T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web script or HTML via the title parameter in a list action to plugins/rrdPlugin.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
denial of service in module-rtp-recv
CVE: CVE-2014-3970
Component: pulseaudio
Severity: Low
Release date: 2014-05-31T00:00:00+00:00

The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
use-after-free in FFmpeg
CVE: CVE-2014-7933
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2014-01-01T00:00:00+00:00

Use-after-free vulnerability in the matroska_read_seek function in libavformat/matroskadec.c in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
multiple temporary file issues
CVE: CVE-2014-3423
Component: emacs
CWE: CWE-377
Severity: Low
Release date: 2014-05-05T00:00:00+00:00

lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
DoS in IcnsImagePlugin
CVE: CVE-2014-3589
Component: python-imaging
CWE: CWE-835
Severity: Moderate
Release date: 2014-08-13T00:00:00+00:00

PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.


Remediation:
specially-crafted environment variables can be used to inject shell commands
CVE: CVE-2014-6271
Component: bash
CWE: CWE-78
Severity: Critical
Release date: 2014-09-24T00:00:00+00:00

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.


Remediation:
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To upgrade Hypervisors in Red Hat Enterprise Virtualization environments
using the disk image provided by this package, refer to:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html
Address bar spoofing
CVE: CVE-2014-7899
Component: chromium-browser
CWE: CWE-451
Severity: Moderate
Release date: 2014-11-18T00:00:00+00:00

Google Chrome before 38.0.2125.101 allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
unspecified vulnerabilities fixed in 8u5 (JavaFX, Scripting)
CVE: CVE-2014-0464
Component: JDK
Severity: Critical
Release date: 2014-04-15T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality via unknown vectors related to Scripting, a different vulnerability than CVE-2014-0463.


Remediation:
Heap-overflow in procmail's formail utility when processing specially-crafted email headers
CVE: CVE-2014-3618
Component: procmail
CWE: CWE-122
Severity: Important
Release date: 2014-09-04T00:00:00+00:00

A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Ruby modules could be loaded from the current working directory
CVE: CVE-2014-3248
Component: puppet
CWE: CWE-829
Severity: Moderate
Release date: 2014-06-10T00:00:00+00:00

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.

Statement: This issue did not affect the versions of Puppet, Mcollective, Facter, or Hiera as shipped with various Red Hat Enterprise products as they all run on top of Ruby 1.9.3 or later.

Remediation:
unprivileged arbitrary module load via basename abuse
CVE: CVE-2014-9645
Component: busybox
CWE: CWE-228
Severity: Low
Release date: 2014-11-19T00:00:00+00:00

The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

Statement: This issue affects the versions of busyboxas shipped with Red Hat Enterprise Linux 4, 5 and 6. Red Hat Product Security has rated this issue as having a low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation: