huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unspecified vulnerability fixed in 6u71 and 7u51 (Deployment)
CVE: CVE-2013-5898
Component: JDK
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2014-0375 and CVE-2014-0403.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
DCP-ETSI dissector crash (wnpa-sec-2013-07, bug 8213)
CVE: CVE-2013-1588
Component: wireshark
Severity: Moderate
Release date: 2013-01-29T00:00:00+00:00

Multiple buffer overflows in the dissect_pft_fec_detailed function in the DCP-ETSI dissector in epan/dissectors/packet-dcp-etsi.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allow remote attackers to cause a denial of service (application crash) via a malformed packet.

Statement: Not Vulnerable. This issue does not affect the version of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
net: permissions flaw in /proc/sys/net
CVE: CVE-2013-4270
Component: kernel
Severity: Moderate
Release date: 2013-10-06T00:00:00+00:00

The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
multiple code execution flaws (APSB13-14)
CVE: CVE-2013-3331
Component: flash-plugin
Severity: Critical
Release date: 2013-05-14T00:00:00+00:00

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3327, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
denial of service when handling IKEv1 fragmentation payloads
CVE: CVE-2013-6076
Component: strongswan
Severity: Moderate
Release date: 2013-11-01T00:00:00+00:00

strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet.

Statement: Not Vulnerable. This issue does not affect the version of openswan as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
TLS CBC padding timing attack (lucky-13)
CVE: CVE-2013-1619
Component: gnutls
Severity: Moderate
Release date: 2013-02-04T00:00:00+00:00

The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

To upgrade Hypervisors in Red Hat Enterprise Virtualization 
environments using the disk image provided by this package, refer to:

https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Hypervisor_Deployment_Guide/chap-Deployment_Guide-Upgrading_Red_Hat_Enterprise_Virtualization_Hypervisors.html
CFN policy rules not all enforced
CVE: CVE-2013-6426
Component: Heat
Severity: Moderate
Release date: 2013-12-11T00:00:00+00:00

The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Documentation for releases of Red Hat Enterprise Linux OpenStack Platform
is available at
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/
insufficient security checks (JAXWS, 8017505)
CVE: CVE-2013-5820
Component: OpenJDK
Severity: Moderate
Release date: 2013-10-15T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect integrity via vectors related to JAX-WS.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
insecure use of system()
CVE: CVE-2013-4362
Component: davfs2
Release date: 2013-09-15T00:00:00+00:00

WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
insecure software download with mirroring support
CVE: CVE-2013-5123
Component: python-pip
Severity: Moderate
Release date: 2013-07-31T00:00:00+00:00

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.


Remediation:
Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
CVE: CVE-2013-0771
Component: Mozilla
CWE: CWE-119
Severity: Critical
Release date: 2013-01-08T00:00:00+00:00

Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.

Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
Samba 4.0 AD DC files (initially) created as world-writable if additional CIFS file shares are created on the AD DC
CVE: CVE-2013-1863
Component: samba4
CWE: CWE-732
Severity: Moderate
Release date: 2013-03-19T00:00:00+00:00

Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.

Statement: Not Vulnerable. This issue does not affect the version of samba4 as shipped with Red Hat Enterprise Linux 6.

Remediation:
default markup formatter permits offsite-bound forms (SECURITY-88)
CVE: CVE-2013-5573
Component: jenkins
CWE: CWE-96
Severity: Moderate
Release date: 2013-12-16T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.


Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

See the OpenShift Enterprise 2.1 Release Notes, which will be updated shortly for this advisory, for important instructions on how to fully apply this asynchronous errata update:

https://access.redhat.com/site/documentation/en-US/OpenShift_Enterprise/2/html-single/2.1_Release_Notes/index.html#chap-Asynchronous_Errata_Updates

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258.
'MyspacePolicy' permits
tag("form", "action", ONSITE_OR_OFFSITE_URL, "method");

Fix 'MyspacePolicy' by restricting the policy to ONSITE_URL only or perhaps <form> could be banned entirely.
server certificate validation is always disabled when connecting to Aviary servers
CVE: CVE-2013-0264
Component: cumin
Severity: Moderate
Release date: 2013-02-06T00:00:00+00:00

An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.

Statement: Not vulnerable. This issue did not affect the versions of cumin as shipped with Red Hat Enterprise MRG 1 or 2.

Remediation:
multiple code execution flaws (APSB13-04)
CVE: CVE-2013-0634
Component: flash-plugin
Severity: Critical
Release date: 2013-02-07T00:00:00+00:00

Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in February 2013.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
class loader sharing for applets with same codebase paths
CVE: CVE-2013-1926
Component: icedtea-web
Severity: Moderate
Release date: 2013-04-17T00:00:00+00:00

The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
post-auth memory corruption when using AES-GCM cipher
CVE: CVE-2013-4548
Component: openssh
Severity: Moderate
Release date: 2013-11-07T00:00:00+00:00

The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.

Statement: Not vulnerable. This issue did not affect the versions of openssh as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for AES-GCM cipher suites.

Remediation:
multiple code execution flaws (APSB13-14)
CVE: CVE-2013-3327
Component: flash-plugin
Severity: Critical
Release date: 2013-05-14T00:00:00+00:00

Adobe Flash Player before 10.3.183.86 and 11.x before 11.7.700.202 on Windows and Mac OS X, before 10.3.183.86 and 11.x before 11.2.202.285 on Linux, before 11.1.111.54 on Android 2.x and 3.x, and before 11.1.115.58 on Android 4.x; Adobe AIR before 3.7.0.1860; and Adobe AIR SDK & Compiler before 3.7.0.1860 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-2728, CVE-2013-3324, CVE-2013-3325, CVE-2013-3326, CVE-2013-3328, CVE-2013-3329, CVE-2013-3330, CVE-2013-3331, CVE-2013-3332, CVE-2013-3333, CVE-2013-3334, and CVE-2013-3335.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Multiple security fixes in  versions after 1.1.0-beta1
CVE: CVE-2013-4118
Component: freerdp
Severity: Moderate
Release date: 2013-01-10T00:00:00+00:00

FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.


Remediation:
middleware memcache encryption and signing bypass
CVE: CVE-2013-2166
Component: python-keystoneclient
CWE: CWE-349
Severity: Important
Release date: 2013-06-19T00:00:00+00:00

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
run command dialog visible above screen locker
CVE: CVE-2013-7221
Component: gnome-shell
Severity: Moderate
Release date: 2013-11-14T00:00:00+00:00

The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation.


Remediation:
multiple XSS flaws in included Jplayer.as
CVE: CVE-2013-2023
Component: owncloud
Release date: 2013-04-20T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to incomplete blacklists, a different vulnerability than CVE-2013-1942 and CVE-2013-2022.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Memory corruption when parsing invalid PLCF data by processing certain DOC files
CVE: CVE-2013-2189
Component: libreoffice
Severity: None
Release date: 2013-07-26T00:00:00+00:00

Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.

Statement: We do not consider a denial of service flaw in a client application such as OpenOffice to be a security issue.

Remediation:
org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters
CVE: CVE-2013-6430
Component: Framework
Severity: Moderate
Release date: 2013-01-01T00:00:00+00:00

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.


Remediation:
The References section of this erratum contains a download link (you must
log in to download the update).
All users of Red Hat JBoss Fuse 6.0.0 as provided from the Red Hat Customer
Portal are advised to apply this update.

The References section of this erratum contains a download link (you must
log in to download the update).
unspecified integrity and availability issue related to memcached (CPU July 2013)
CVE: CVE-2013-3798
Component: mysql
Severity: Moderate
Release date: 2013-07-17T00:00:00+00:00

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.6.11 and earlier allows remote attackers to affect integrity and availability via unknown vectors related to MemCached.

Statement: Not vulnerable. This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
CVE: CVE-2013-0767
Component: Mozilla
CWE: CWE-119
Severity: Critical
Release date: 2013-01-08T00:00:00+00:00

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
denial of service due to off-by-one flaw in process_cgivars()
CVE: CVE-2013-7108
Component: nagios
CWE: CWE-193
Severity: Moderate
Release date: 2013-12-20T00:00:00+00:00

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.


Remediation: