huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
multiple code execution flaws (APSB15-19)
CVE: CVE-2015-5547
Component: flash-plugin
Severity: Critical
Release date: 2015-08-12T00:00:00+00:00

Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Multiple security issues (MSA-15-0030, MSA-15-0031, MSA-15-0032, MSA-15-0033, MSA-15-0034, MSA-15-0035, MSA-15-0036)
CVE: CVE-2015-5269
Component: moodle
Release date: 2015-09-08T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
missing type checks in IIOPInputStream (CORBA, 8076392)
CVE: CVE-2015-4881
Component: OpenJDK
Severity: Critical
Release date: 2015-10-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
denial of service in case of client requests with incorrect chunk-encoded body
CVE: CVE-2015-1380
Component: privoxy
CWE: CWE-617
Severity: Moderate
Release date: 2015-01-26T00:00:00+00:00

jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.


Remediation:
Redefinition of non-configurable JavaScript object properties (MFSA 2015-82)
CVE: CVE-2015-4478
Component: Mozilla
Severity: Moderate
Release date: 2015-08-11T00:00:00+00:00

Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 do not impose certain ECMAScript 6 requirements on JavaScript object properties, which allows remote attackers to bypass the Same Origin Policy via the reviver parameter to the JSON.parse method.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
stack overflow caused by mishandled group empty match (8.38/11)
CVE: CVE-2015-3217
Component: pcre
CWE: CWE-674
Severity: Moderate
Release date: 2015-06-03T00:00:00+00:00

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the MariaDB server daemon (mysqld) will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Information Exposure Through Directory Listing in the file scanner
CVE: CVE-2015-6500
Component: owncloud
Release date: 2015-08-24T00:00:00+00:00

Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Use-after-free when resizing canvas element during restyling (MFSA 2015-94)
CVE: CVE-2015-4497
Component: Mozilla
CWE: CWE-416
Severity: Critical
Release date: 2015-08-27T00:00:00+00:00

Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
CVE: CVE-2015-7311
Component: xen
Severity: Low
Release date: 2015-09-22T00:00:00+00:00

libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only disk image.

Statement: Not vulnerable.

This issue does not affect the versions of the xen package as shipped with Red Hat Enterprise Linux 5.

Remediation:
Storage overrun by deleting images
CVE: CVE-2015-5286
Component: openstack-glance
CWE: CWE-400
Severity: Moderate
Release date: 2015-10-01T00:00:00+00:00

A race-condition flaw was discovered in the OpenStack Image service (glance). When images in the upload state were deleted using a token close to expiration, untracked image data could accumulate in the back end. Because untracked data does not count towards the storage quota, an attacker could use this flaw to cause a denial of service through resource exhaustion.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Signature validation issue in Android Crazy Linker
CVE: CVE-2015-6783
Component: chromium-browser
Severity: Moderate
Release date: 2015-12-01T00:00:00+00:00

The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.


Remediation:
DTLS segmentation fault in DTLSv1_listen
CVE: CVE-2015-0207
Component: openssl
CWE: CWE-822
Severity: Moderate
Release date: 2015-03-19T00:00:00+00:00

The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server.

Statement: This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
multiple code execution issues fixed in APSB15-05
CVE: CVE-2015-0342
Component: flash-plugin
Severity: Critical
Release date: 2015-03-12T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0341.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Certificate parsing broken by non-standard character encoding (MFSA 2014-65)
CVE: CVE-2014-1560
Component: Mozilla
Severity: Moderate
Release date: 2014-07-22T00:00:00+00:00

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use ASCII character encoding in a required context.

Statement: This issue does not affect the version of thunderbird as shipped with Red Hat Enterprise Linux 5 and 6, or the version of firefox as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
memory leak in rle file handling
CVE: CVE-2014-9853
Component: ImageMagick
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file.


Remediation:
directory traversal flaw in uupdate
CVE: CVE-2014-1833
Component: devscripts
Release date: 2014-01-30T00:00:00+00:00

Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
default password creation
CVE: CVE-2014-0234
Component: openshift-origin-broker
CWE: CWE-798
Severity: Important
Release date: 2014-05-14T00:00:00+00:00

The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

See the latest OpenShift Enterprise Deployment Guide at
https://access.redhat.com/site/documentation/en-US/OpenShift_Enterprise/2/
for instructions on initial installations and upgrades from previous
versions.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258.
Integer overflow in media
CVE: CVE-2014-7908
Component: chromium-browser
CWE: CWE-190
Severity: Important
Release date: 2014-11-18T00:00:00+00:00

Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before 39.0.2171.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data.

Statement: This issue affects the versions of webkitgtk and webkitgtk3 as shipped with Red Hat Enterprise Linux 6 and 7 respectively.

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
session hijacking vulnerability (SA-CORE-2014-006)
CVE: CVE-2014-9015
Component: drupal
Release date: 2014-11-19T00:00:00+00:00

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
receive() missing return on error
CVE: CVE-2014-9296
Component: ntp
CWE: CWE-390
Severity: Low
Release date: 2014-12-19T00:00:00+00:00

A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism.

Statement: This issue did not affect the versions of ntpd as shipped with Red Hat Enterprise Linux 4 and 5.  It has been addressed in Red Hat Enterprise Linux 6 and 7 via RHSA-2014:2024.

Remediation:
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata 
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258
Remove or comment out all configuration directives beginning with the crypto keyword in your ntp.conf file.
database credentials disclosure in MantisBT's unattended upgrade script
CVE: CVE-2014-9279
Component: mantis
Release date: 2014-12-05T00:00:00+00:00

The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
gears fail to properly isolate network traffic
CVE: CVE-2014-3674
Component: Enterprise
CWE: CWE-284
Severity: Moderate
Release date: 2014-11-03T00:00:00+00:00

It was found that OpenShift Enterprise 2.1 did not properly restrict access to services running on different gears. This could allow an attacker to access unprotected network resources running in another user's gear.


Remediation:
Before applying this update, make sure all previously released errata relevant 
to your system have been applied.

See the latest OpenShift Enterprise Deployment Guide at 
https://access.redhat.com/site/documentation/en-US/OpenShift_Enterprise/2/ 
for instructions on initial installations and upgrades from previous 
versions.

This update is available via the Red Hat Network. Details on how to use the 
Red Hat Network to apply this update are available at 
https://access.redhat.com/articles/11258.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

See the OpenShift Enterprise 2.1 Release Notes linked to in the References
section, which will be updated shortly for release 2.1.9, for important
instructions on how to fully apply this asynchronous errata update.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258.
unspecified vulnerability fixed in 7u71 and 8u25 (Deployment)
CVE: CVE-2014-6476
Component: JDK
Severity: Moderate
Release date: 2014-10-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u67 and 8u20 allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-6527.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
unspecified full Java sandbox bypass fixed in Feb 2015 update
CVE: CVE-2014-8891
Component: JDK
Severity: Critical
Release date: 2014-01-01T00:00:00+00:00

Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
JObjC code issues (Hotspot, 8021266)
CVE: CVE-2014-0408
Component: OpenJDK
Severity: Critical
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u45, when running on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Statement: Not vulnerable. This issue did not affect the versions of OpenJDK and Oracle JDK as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
unspecified DoS related to InnoDB (CPU April 2014)
CVE: CVE-2014-2435
Component: mysql
Severity: Low
Release date: 2014-04-15T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.6.16 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.


Remediation:
input validation issue (SECURITY-77)
CVE: CVE-2014-2065
Component: jenkins
CWE: CWE-20
Severity: Moderate
Release date: 2014-02-07T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.


Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

See the OpenShift Enterprise 2.1 Release Notes, which will be updated shortly for this advisory, for important instructions on how to fully apply this asynchronous errata update:

https://access.redhat.com/site/documentation/en-US/OpenShift_Enterprise/2/html-single/2.1_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258.
assertion failure during EDNS option processing
CVE: CVE-2014-3859
Component: bind
Severity: Important
Release date: 2014-06-11T00:00:00+00:00

libdns in ISC BIND 9.10.0 before P2 does not properly handle EDNS options, which allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted packet, as demonstrated by an attack against named, dig, or delv.

Statement: Not vulnerable. This issue did not affect the versions of bind or bind97 as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
out-of-bounds memory error in JPEG decoder
CVE: CVE-2014-8716
Component: ImageMagick
Severity: Low
Release date: 2014-11-13T00:00:00+00:00

The JPEG decoder in ImageMagick before 6.8.9-9 allows local users to cause a denial of service (out-of-bounds memory access and crash).

Statement: Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw in ImageMagick.

Remediation:
infinite loop DoS in vision.c
CVE: CVE-2014-9804
Component: ImageMagick
CWE: CWE-835
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

vision.c in ImageMagick allows remote attackers to cause a denial of service (infinite loop) via vectors related to "too many object."


Remediation: