huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
upstream 2.6.2, 2.5.5, and 2.4.9 fixes
CVE: CVE-2014-2572
Component: moodle
Release date: 2014-03-17T00:00:00+00:00

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
directory traversal in read_long_names()
CVE: CVE-2014-9447
Component: elfutils
CWE: CWE-73
Severity: Low
Release date: 2014-12-27T00:00:00+00:00

Directory traversal vulnerability in the read_long_names function in libelf/elf_begin.c in elfutils 0.152 and 0.161 allows remote attackers to write to arbitrary files to the root directory via a / (slash) in a crafted archive, as demonstrated using the ar program.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Race condition in the ip4_datagram_release_cb function
CVE: CVE-2014-9914
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 7.0/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2014-06-10T00:00:00+00:00

A race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux and realtime kernels.

Remediation:
root_storage NULL pointer deference flaw in CDF parser
CVE: CVE-2014-0236
Component: file
Severity: Moderate
Release date: 2014-06-27T00:00:00+00:00

file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.

Statement: Not vulnerable. This issue did not affect the versions of file, php, and php53 as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
crash when parsing resource block
CVE: CVE-2014-9851
Component: ImageMagick
CWE: CWE-20
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash).


Remediation:
insecure use of temporary files
CVE: CVE-2014-1831
Component: rubygem-passenger
CWE: CWE-377
Severity: Low
Release date: 2014-01-28T00:00:00+00:00

Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.


Remediation:
Miscellaneous memory safety hazards (rv:rv:24.8) (MFSA 2014-67)
CVE: CVE-2014-1562
Component: Mozilla
Severity: Critical
Release date: 2014-09-03T00:00:00+00:00

Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
deep recursion stack overflow
CVE: CVE-2014-4330
Component: perl-Data-Dumper
CWE: CWE-674
Severity: Low
Release date: 2014-09-18T00:00:00+00:00

The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.


Remediation:
SQL injection vulnerability in 'bitstring' quoting
CVE: CVE-2014-3482
Component: rubygem-activerecord
CWE: CWE-89
Severity: Moderate
Release date: 2014-07-02T00:00:00+00:00

It was discovered that Active Record did not properly quote values of the bitstring type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record.

Statement: This issue does not affect CloudForms 5 as it does not use the "bitstring" data type anywhere in the product.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
security issues fixed in versions 2.7.3, 2.6.6 and 2.5.9
CVE: CVE-2014-7838
Component: moodle
Release date: 2014-11-10T00:00:00+00:00

Multiple cross-site request forgery (CSRF) vulnerabilities in the Forum module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allow remote attackers to hijack the authentication of arbitrary users for requests that set a tracking preference within (1) mod/forum/deprecatedlib.php, (2) mod/forum/forum.js, (3) mod/forum/index.php, or (4) mod/forum/lib.php.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
credentials leak via MD5 collision
CVE: CVE-2014-3528
Component: subversion
CWE: CWE-201
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the credentials for a different realm.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
incorrect error handling in sun files
CVE: CVE-2014-9826
Component: ImageMagick
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

ImageMagick allows remote attackers to have unspecified impact via vectors related to error handling in sun files.


Remediation:
/etc/hammer/cli.modules.d/foreman.yml is world-readable
CVE: CVE-2014-0241
Component: rubygem-hammer_cli_foreman
CWE: CWE-522
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

rubygem-hammer_cli_foreman: File /etc/hammer/cli.modules.d/foreman.yml world readable


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Subscription Manageemnt.
Details on how to use Red Hat Subscription Management are available at
https://access.redhat.com/articles/433903.
multiple vulnerabilities
CVE: CVE-2014-6395
Component: ettercap
Release date: 2014-12-16T00:00:00+00:00

Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
information leak in XSS Auditor fixed in Chrome 38.0.2125.101
CVE: CVE-2014-3197
Component: chromium
CWE: CWE-200
Severity: Moderate
Release date: 2014-10-07T00:00:00+00:00

The NavigationScheduler::schedulePageBlock function in core/loader/NavigationScheduler.cpp in Blink, as used in Google Chrome before 38.0.2125.101, does not properly provide substitute data for pages blocked by the XSS auditor, which allows remote attackers to obtain sensitive information via a crafted web site.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
ALSA: control: protect user controls against races & memory disclosure
CVE: CVE-2014-4652
Component: Kernel
Severity: Low
Release date: 2014-06-18T00:00:00+00:00

An information leak flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled access of the user control's state. A local, privileged user could use this flaw to leak kernel memory to user space.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
Red Hat would like to thank Frey Alfredsson for reporting CVE-2014-3631,
and Vasily Averin of Parallels for reporting CVE-2014-5045. The
CVE-2014-3673 was discovered by Liu Wei of Red Hat.

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
memory address layout randomization defeat (APSB14-02)
CVE: CVE-2014-0492
Component: flash-plugin
Severity: Critical
Release date: 2014-01-14T00:00:00+00:00

Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak."


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
multiple code execution or security bypass flaws (APSB14-18)
CVE: CVE-2014-0538
Component: flash-plugin
Severity: Critical
Release date: 2014-08-12T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allows attackers to execute arbitrary code via unspecified vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
NULL pointer dereference flaw in mod_dav_svn when handling URIs for virtual transaction names
CVE: CVE-2014-8108
Component: subversion
CWE: CWE-476
Severity: Moderate
Release date: 2014-12-15T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the mod_dav_svn module handled certain requests for URIs that trigger a lookup of a virtual transaction name. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash.

Statement: This issue did not affect the versions of subversion as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
cross-site scripting flaw fixed in the 1.7.2 release
CVE: CVE-2014-2856
Component: cups
CWE: CWE-79
Severity: Moderate
Release date: 2014-01-30T00:00:00+00:00

A cross-site scripting (XSS) flaw was found in the CUPS web interface. An attacker could use this flaw to perform a cross-site scripting attack against users of the CUPS web interface.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata/

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
arbitrary code execution and denial of service via a crafted web site (WSA-2015-0001)
CVE: CVE-2014-1329
Component: webkitgtk
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.

Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
kvm: invalid parameter passing in kvm_iommu_map_pages()
CVE: CVE-2014-3601
Component: kernel
Severity: Moderate
Release date: 2014-08-19T00:00:00+00:00

A flaw was found in the way the Linux kernel's kvm_iommu_map_pages() function handled IOMMU mapping failures. A privileged user in a guest with an assigned host device could use this flaw to crash the host.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
remote command execution when command arguments are enabled
CVE: CVE-2014-2913
Component: nrpe
Severity: Important
Release date: 2014-04-17T00:00:00+00:00

Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe.  NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments


Remediation:
server NULL pointer dereference flaw in ClientCutText message handling
CVE: CVE-2014-6053
Component: libvncserver
CWE: CWE-476
Severity: Moderate
Release date: 2014-09-23T00:00:00+00:00

A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
aes_security.rb file creation vulnerability
CVE: CVE-2014-3251
Component: mcollective
CWE: CWE-348
Severity: Moderate
Release date: 2014-07-15T00:00:00+00:00

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.

Statement: Red Hat OpenShift Enterprise 2 is now in Production 1 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat OpenShift Enterprise 2 Life Cycle: https://access.redhat.com/support/policy/updates/openshift.

Remediation:
security groups bypass through invalid CIDR
CVE: CVE-2014-0187
Component: openstack-neutron
Severity: Moderate
Release date: 2014-04-22T00:00:00+00:00

The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
unspecified vulnerability related to Client (CPU April 2014)
CVE: CVE-2014-2440
Component: mysql
Severity: None
Release date: 2014-04-15T00:00:00+00:00

Unspecified vulnerability in the MySQL Client component in Oracle MySQL 5.5.36 and earlier and 5.6.16 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.

Statement: This flaw was found to be a duplicate of CVE-2014-0001. Please see https://access.redhat.com/security/cve/CVE-2014-0001 for information about affected products and security errata.

Remediation:
various security flaws
CVE: CVE-2014-8763
Component: dokuwiki
Release date: 2014-09-29T00:00:00+00:00

DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
insecure temporary file issues leading to privilege escalation
CVE: CVE-2014-3986
Component: lynis
Release date: 2014-06-04T00:00:00+00:00

include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: