huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
unspecified vulnerability fixed in 8u65 (JavaFX)
CVE: CVE-2015-4901
Component: JDK
Severity: Critical
Release date: 2015-10-20T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 8u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
ozwpan: improper bounds checking leads to DoS or heap overflow
CVE: CVE-2015-4002
Component: kernel
CWE: CWE-119
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Release date: 2015-05-13T00:00:00+00:00

drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.

Statement: Red Hat Enterprise Linux is not affected by this flaw as the OZWPAN USB Host Controller driver (CONFIG_USB_WPAN_HCD) is not enabled in any current shipping kernels.

Remediation:
NULL pointer access in 7z parser
CVE: CVE-2015-8922
Component: libarchive
CWE: CWE-476
Severity: Low
CVSS v3: 3.3/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L
Release date: 2015-01-01T00:00:00+00:00

A vulnerability was found in libarchive.  A specially crafted 7Z file could trigger a NULL pointer dereference, causing the application to crash.


Remediation:
race condition in setting permissions on output file
CVE: CVE-2015-1200
Component: pxz
Release date: 2015-01-13T00:00:00+00:00

Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap overflow in bmp_decode_rle() and out-of-bounds read in bmp_decode_rle()/bmp_decode_rgb()
CVE: CVE-2015-7507
Component: libnsbmp
Release date: 2015-12-16T00:00:00+00:00

libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a crafted color table to the (1) bmp_decode_rgb or (2) bmp_decode_rle function.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
X server started without -auth, exposing it to connections form any local user
CVE: CVE-2015-8308
Component: lxdm
Release date: 2015-10-05T00:00:00+00:00

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
password length memory corruption vulnerability
CVE: CVE-2015-7854
Component: ntp
CWE: CWE-119
Severity: Moderate
Release date: 2015-10-21T00:00:00+00:00

Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.

Statement: This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Remediation:
information disclosure issues fixed in APSB15-16
CVE: CVE-2015-3114
Component: flash-plugin
Severity: Moderate
Release date: 2015-07-08T00:00:00+00:00

Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
lookupProviders() null pointer dereference
CVE: CVE-2015-5185
Component: sblim-sfcb
CWE: CWE-476
Severity: Moderate
Release date: 2015-08-20T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the lookupProviders() function processed certain requests without "className" information. An authenticated remote attacker could use this flaw to cause a denial of service (sfcbd crash) by sending a specially crafted request.

Statement: This issue affects the versions of sblim-sfcb as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
unauthorized WNM Sleep Mode GTK control
CVE: CVE-2015-5310
Component: wpa_supplicant
Severity: Low
Release date: 2015-11-10T00:00:00+00:00

The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 does not properly ignore key data in response frames when management frame protection (MFP) was not negotiated, which allows remote attackers to inject arbitrary broadcast or multicast packets or cause a denial of service (ignored packets) via a WNM Sleep Mode response.

Statement: Not vulnerable. This issue did not affect the versions of wpa_supplicant as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they do not include the WNM functionality.

Remediation:
HTTP request smuggling in net/http library
CVE: CVE-2015-5740
Component: golang
CWE: CWE-444
Severity: Moderate
Release date: 2015-07-29T00:00:00+00:00

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error (the second field is ignored), and invalid fields are parsed as valid (for example, "Content Length:" with a space in the middle is accepted).  A non-authenticated attacker could exploit these flaws to bypass security controls, perform web-cache poisoning, or alter the request/response map (denial of service).


Remediation:
Miscellaneous memory safety hazards (MFSA 2015-96)
CVE: CVE-2015-4501
Component: Mozilla
Severity: Critical
Release date: 2015-09-22T00:00:00+00:00

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.


Remediation:
Out of bounds read in QCMS library (MFSA 2015-34)
CVE: CVE-2015-0811
Component: Mozilla
CWE: CWE-125
Severity: Moderate
Release date: 2015-03-31T00:00:00+00:00

The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Remediation:
CVE: CVE-2015-6496
Component: conntrackd crash on unexpected network traffic
Severity: Moderate
Release date: 2015-01-01T00:00:00+00:00

conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows remote attackers to cause a denial of service (crash) via a (1) DCCP, (2) SCTP, or (3) ICMPv6 packet.


Remediation:
integer overflow in the conversion of dates to "Julian Day Count" function
CVE: CVE-2015-1353
Component: php
CWE: CWE-190
Severity: Low
Release date: 2015-01-20T00:00:00+00:00

No description is available for this CVE.


Remediation:
Use-after-free in opj_j2k_write_mco function
CVE: CVE-2015-8871
Component: openjpeg
CWE: CWE-416
Severity: Moderate
Release date: 2015-09-15T00:00:00+00:00

Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.


Remediation:
Use-after-free in v8 bindings
CVE: CVE-2015-1216
Component: chromium-browser
CWE: CWE-416
Severity: Important
Release date: 2015-03-03T00:00:00+00:00

Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
out of bounds heap read in RAR parser
CVE: CVE-2015-8934
Component: libarchive
CWE: CWE-125
Severity: Low
CVSS v3: 3.6/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2015-01-01T00:00:00+00:00

A vulnerability was found in libarchive.  A specially crafted RAR file could cause the application to read memory beyond the end of the decompression buffer.


Remediation:
Denial of service attack against Windows Active Directory server.
CVE: CVE-2015-8467
Component: samba
Severity: Moderate
Release date: 2015-12-16T00:00:00+00:00

The samldb_check_user_account_control_acl function in dsdb/samdb/ldb_modules/samldb.c in Samba 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 does not properly check for administrative privileges during creation of machine accounts, which allows remote authenticated users to bypass intended access restrictions by leveraging the existence of a domain with both a Samba DC and a Windows DC, a similar issue to CVE-2015-2535.


Remediation:
deserialization issue in ObjectInputStream.readSerialData() (Libraries, 8076401)
CVE: CVE-2015-2590
Component: OpenJDK
Severity: Critical
Release date: 2015-07-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
multiple code execution issues fixed in APSB15-25
CVE: CVE-2015-7638
Component: flash-plugin
Severity: Critical
Release date: 2015-10-13T00:00:00+00:00

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
v8 denial of service
CVE: CVE-2015-5605
Component: chromium-browser
Severity: Moderate
Release date: 2015-07-23T00:00:00+00:00

The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
same-origin-policy bypass fixed in APSB15-11
CVE: CVE-2015-3102
Component: flash-plugin
Severity: Moderate
Release date: 2015-06-09T00:00:00+00:00

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3098 and CVE-2015-3099.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Use-after-free during text processing with vertical text enabled (MFSA 2015-51)
CVE: CVE-2015-2713
Component: Mozilla
CWE: CWE-416
Severity: Critical
Release date: 2015-05-12T00:00:00+00:00

Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
side-channel attack on ECDH with Weierstrass curves
CVE: CVE-2015-7511
Component: libgcrypt
Severity: Low
Release date: 2015-01-01T00:00:00+00:00

Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.


Remediation:
unspecified vulnerability related to Server:DDL (CPU Jan 2015)
CVE: CVE-2015-0391
Component: mysql
Severity: Moderate
Release date: 2015-01-21T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Risk of BREACH attack due to reflected parameter (PMASA-2015-1)
CVE: CVE-2015-2206
Component: phpMyAdmin
Release date: 2015-03-04T00:00:00+00:00

libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
GSM RLC/MAC dissector infinite loop (wnpa-sec-2015-25)
CVE: CVE-2015-6245
Component: wireshark
CWE: CWE-835
Severity: Moderate
Release date: 2015-08-11T00:00:00+00:00

epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

Statement: This issue did not affect the version of wireshark as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Cross-origin bypass in V8
CVE: CVE-2015-1304
Component: chromium-browser
CWE: CWE-284
Severity: Important
Release date: 2015-09-24T00:00:00+00:00

object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
race condition between chown() and execve()
CVE: CVE-2015-3339
Component: kernel
CWE: CWE-362
Severity: Moderate
Release date: 2015-04-20T00:00:00+00:00

A race condition flaw was found between the chown and execve system calls. When changing the owner of a setuid user binary to root, the race condition could momentarily make the binary setuid root. A local, unprivileged user could potentially use this flaw to escalate their privileges on the system.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 7 and MRG-2. This issue is not currently planned to be addressed in future Red Hat Enterprise Linux 5 kernel updates.  Future Linux kernel updates for other releases may address this issue.

For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Red Hat would like to thank Nadav Amit for reporting the CVE-2010-5313,
CVE-2014-3647, CVE-2014-7842, and CVE-2015-0239 issues; and Linn Crosetto
of HP for reporting the CVE-2015-7837 issue. The CVE-2015-5283 issue was
discovered by Ji Jianwen from Red Hat engineering.

This update fixes several hundred bugs and adds numerous enhancements.
Refer to the Red Hat Enterprise Linux 7.2 Release Notes for information on
the most significant of these changes, and the following Knowledge base
article for further information:

https://access.redhat.com/articles/1749293

All Red Hat Enterprise Linux 7 users are advised to install these updated
packages, which correct these issues and add these enhancements. The system
must be rebooted for this update to take effect.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258