huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
stack exhaustion while parsing xml files in recovery mode
CVE: CVE-2016-3627
Component: libxml2
CWE: CWE-674
Severity: Moderate
Release date: 2016-03-21T00:00:00+00:00

Missing recursive loop detection checks were found in the xmlParserEntityCheck() and xmlStringGetNodeList() functions of libxml2, causing application using the library to crash by stack exhaustion while building the associated data. An attacker able to send XML data to be parsed in recovery mode could launch a Denial of Service on the application.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications linked to the libxml2 library must be restarted, or the system rebooted.
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

After installing the updated packages, the httpd daemon will be restarted automatically.
ASN.1 BER dissector crash (wnpa-sec-2016-15)
CVE: CVE-2016-4418
Component: wireshark
Severity: Moderate
Release date: 2016-02-26T00:00:00+00:00

epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers an empty set.


Remediation:
Race condition in sclp_ctl_ioctl_sccb function leads to information leak
CVE: CVE-2016-6130
Component: kernel
CWE: CWE-367
Severity: Low
CVSS v3: 2.3/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2016-04-25T00:00:00+00:00

Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability.


Remediation:
net: vmxnet3: use-after-free while writing to device
CVE: CVE-2016-6833
Component: Qemu
CWE: CWE-416
Severity: Low
CVSS v3: 3.7/CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-08-09T00:00:00+00:00

Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.


Remediation:
DNP3 dissector infinite loop (wnpa-sec-2016-03)
CVE: CVE-2016-2523
Component: wireshark
Severity: Moderate
Release date: 2016-02-26T00:00:00+00:00

The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Remediation:
remote code execution
CVE: CVE-2016-2173
Component: springframework-amqp
Release date: 2016-04-11T00:00:00+00:00

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
WebRTC and LibVPX vulnerabilities found through code inspection (MFSA 2016-32)
CVE: CVE-2016-1972
Component: Mozilla
Severity: Moderate
Release date: 2016-03-08T00:00:00+00:00

Race condition in libvpx in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
out of bounds memory access in v8
CVE: CVE-2016-5198
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-11-01T00:00:00+00:00

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
display: virtio-gpu: memory leakage when destroying gpu resource
CVE: CVE-2016-9912
Component: Qemu
CWE: CWE-244
Severity: Low
CVSS v3: 2.8/CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2016-11-28T00:00:00+00:00

Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.


Remediation:
Out-of-bounds read in dwarf_get_xu_hash_entry()
CVE: CVE-2016-5032
Component: libdwarf
CWE: CWE-125
Severity: Low
Release date: 2016-05-18T00:00:00+00:00

The dwarf_get_xu_hash_entry function in libdwarf before 20160923 allows remote attackers to cause a denial of service (crash) via a crafted file.


Remediation:
Null pointer dereference in do_refill
CVE: CVE-2016-9441
Component: w3m
CWE: CWE-476
Severity: Low
CVSS v3: 4.2/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-08-20T00:00:00+00:00

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page.


Remediation:
multiple code execution issues fixed in APSB16-32
CVE: CVE-2016-4273
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-10-11T00:00:00+00:00

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6982, CVE-2016-6983, CVE-2016-6984, CVE-2016-6985, CVE-2016-6986, CVE-2016-6989, and CVE-2016-6990.


Remediation:
Memory allocation failure in wmf_malloc
CVE: CVE-2016-9011
Component: libwmf
CWE: CWE-131
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-10-18T00:00:00+00:00

The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.


Remediation:
cross-site scripting fixed in wordpress 4.4.1
CVE: CVE-2016-1564
Component: wordpress
Release date: 2016-01-06T00:00:00+00:00

Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap use-after-free in htmlPArsePubidLiteral and htmlParseSystemiteral
CVE: CVE-2016-1837
Component: libxml2
CWE: CWE-416
Severity: Moderate
Release date: 2016-05-23T00:00:00+00:00

Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allow remote attackers to cause a denial of service via a crafted XML document.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications linked to the libxml2 library must be restarted, or the system rebooted.
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

After installing the updated packages, the httpd daemon will be restarted automatically.
XSS vulnerability in course management search
CVE: CVE-2016-0725
Component: moodle
Release date: 2016-01-18T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use after free in v8
CVE: CVE-2016-5177
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-29T00:00:00+00:00

Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Divide-by-zero in the intersect function
CVE: CVE-2016-10219
Component: ghostscript
CWE: CWE-369
Severity: Low
CVSS v3: 3.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2016-12-23T00:00:00+00:00

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.


Remediation:
Multiple vulnerabilities fixed in 4.0.10.18, 4.4.15.9 and 4.6.5 versions
CVE: CVE-2016-9857
Component: phpMyAdmin
Release date: 2016-11-25T00:00:00+00:00

An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
information disclosure due to incorrect Processor sharing
CVE: CVE-2016-8745
Component: tomcat
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2016-12-12T00:00:00+00:00

A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body.


Remediation:
Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

The References section of this erratum contains a download link (you must log in to download the update).
Two vulnerabilities fixed in libgit 0.25.1 and 0.24.6
CVE: CVE-2016-10130
Component: libgit2
Release date: 2016-01-01T00:00:00+00:00

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mogrify buffer over-read in profile.c
CVE: CVE-2016-7799
Component: ImageMagick
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2016-09-30T00:00:00+00:00

MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.


Remediation:
DoS in MSM V4L2 video driver
CVE: CVE-2016-2061
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-06-06T00:00:00+00:00

Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call.


Remediation:
multiple code execution issues fixed in APSB16-29
CVE: CVE-2016-6921
Component: flash-plugin
Severity: Critical
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-09-13T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4272, CVE-2016-4279, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, and CVE-2016-6932.


Remediation:
SMB1 client connections can be downgraded to plaintext authentication
CVE: CVE-2016-2124
Component: samba
CWE: CWE-287
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2016-01-01T00:00:00+00:00

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.

For details on migrating Samba/CTDB configuration files, refer to: 

https://access.redhat.com/solutions/4311261
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.

For details on migrating Samba/CTDB configuration files, refer to: 

https://access.redhat.com/solutions/4311261
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, the smb service will be restarted automatically.
Ensure the following [global] smb.conf parameters are set to their default values as shown below:

~~~
  client lanman auth = no
  client NTLMv2 auth = yes
  client plaintext auth = no
  client min protocol = SMB2_02
~~~

Or use the '-k' command line option only without the -U option, which will make use of an existing krb5 ccache.
insecure use of 'git log' command
CVE: CVE-2016-10075
Component: python-tqdm
CVSS v3: 2.5/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2016-12-28T00:00:00+00:00

The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free in extensions
CVE: CVE-2016-1708
Component: chromium-browser
Severity: Important
CVSS v3: 8.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2016-07-20T00:00:00+00:00

The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Chromium must be restarted for the changes to take effect.
Out-of-bounds read in mozilla::net::IsValidReferrerPolicy (MFSA 2016-85)
CVE: CVE-2016-2827
Component: Mozilla
Severity: Low
CVSS v3: 5.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-09-20T00:00:00+00:00

The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a Content Security Policy (CSP) referrer directive with zero values.


Remediation:
allows ExecuteCountQueryCommand.java SQL injection
CVE: CVE-2016-11023
Component: odata4j
CWE: CWE-89
Severity: Low
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2016-05-11T00:00:00+00:00

odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.


Remediation:
Several integer overflows
CVE: CVE-2016-9085
Component: libwebp
CWE: CWE-190
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2016-10-10T00:00:00+00:00

Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.


Remediation:
SQL injection vulnerability in /cacti/tree.php
CVE: CVE-2016-3172
Component: cacti
Release date: 2016-03-10T00:00:00+00:00

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Multiple security issues
CVE: CVE-2016-8694
Component: potrace
Release date: 2016-08-18T00:00:00+00:00

The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted BMP image, a different vulnerability than CVE-2016-8695 and CVE-2016-8696.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
wddx_deserialize null dereference with invalid xml
CVE: CVE-2016-7131
Component: php
Severity: Moderate
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2016-09-02T00:00:00+00:00

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
TLS session resumption client cert bypass
CVE: CVE-2016-5419
Component: curl
CWE: CWE-295
Severity: Moderate
CVSS v3: 4.7/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2016-08-03T00:00:00+00:00

It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files).

After installing the updated packages, the httpd daemon will be restarted automatically.
Heap-buffer-overflow in EnhWMFReader::ReadEnhWMF
CVE: CVE-2016-10327
Component: libreoffice
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.2/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2016-12-30T00:00:00+00:00

LibreOffice before 2016-12-22 has an out-of-bounds write caused by a heap-based buffer overflow related to the EnhWMFReader::ReadEnhWMF function in vcl/source/filter/wmf/enhwmf.cxx.


Remediation: