huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
connection does not validate certificate attributes.
CVE: CVE-2014-3706
Component: ovirt-engine
CWE: CWE-295
Severity: Moderate
Release date: 2014-01-01T00:00:00+00:00

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.

Statement: This issue affects the versions of ovirt-engine as shipped with Red Hat MRG 3. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
incorrect optimization of range checks in C2 compiler (Hotspot, 8022783)
CVE: CVE-2014-6504
Component: OpenJDK
Severity: Moderate
Release date: 2014-10-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, and 7u67, and Java SE Embedded 7u60, allows remote attackers to affect confidentiality via unknown vectors related to Hotspot.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
unserializing certain form input leads to code execution
CVE: CVE-2014-1691
Component: horde
Release date: 2014-01-01T00:00:00+00:00

The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
tagging image to ID can redirect images on subsequent pulls
CVE: CVE-2014-5282
Component: docker
Severity: Low
Release date: 2014-10-16T00:00:00+00:00

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.


Remediation:
PostgreSQL array data injection vulnerability
CVE: CVE-2014-0080
Component: rubygem-activerecord
Severity: Moderate
Release date: 2014-02-18T00:00:00+00:00

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

Statement: Not vulnerable. This issue did not affect the versions of rubygem-activerecord as shipped with CloudForms, OpenShift Enterprise 1 and 2, Red Hat Enterprise Linux OpenStack Platform 3 and 4, Red Hat Software Collections 1 and Subscription Asset Manager as they did not include the vulnerable code.

Remediation:
ssl_accept may block connections on uncompleted handshake
CVE: CVE-2014-7968
Component: vdsm
Severity: Moderate
Release date: 2014-10-02T00:00:00+00:00

VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258
HID: logitech-dj OOB array access
CVE: CVE-2014-3182
Component: Kernel
Severity: Low
Release date: 2014-08-21T00:00:00+00:00

An out-of-bounds read flaw was found in the way the Logitech Unifying receiver driver handled HID reports with an invalid device_index value. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system.

Statement: This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5 and 6.

This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2 may address this issue.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Red Hat would like to thank Frey Alfredsson for reporting CVE-2014-3631,
and Vasily Averin of Parallels for reporting CVE-2014-5045. The
CVE-2014-3673 was discovered by Liu Wei of Red Hat.

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

To install kernel packages manually, use "rpm -ivh [package]". Do not use
"rpm -Uvh" as that will remove the running kernel binaries from your
system. You may use "rpm -e" to remove old kernels after determining that
the new kernel functions properly on your system.
mconvert incorrect handling of truncated pascal string size
CVE: CVE-2014-3478
Component: file
Severity: Moderate
Release date: 2014-06-27T00:00:00+00:00

A buffer overflow flaw was found in the way the File Information (fileinfo) extension processed certain Pascal strings. A remote attacker able to make a PHP application using fileinfo convert a specially crafted Pascal string provided by an image file could cause that application to crash.

Statement: This issue did not affect the versions of file, php, and php53 as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the versions of file as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
wanxl: information leak in ioctl
CVE: CVE-2014-1445
Component: Kernel
Severity: Low
Release date: 2014-01-01T00:00:00+00:00

The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

Remediation:
Double-free in zend_ts_hash_graceful_destroy()
CVE: CVE-2014-9425
Component: php
CWE: CWE-416
Severity: Low
Release date: 2014-12-30T00:00:00+00:00

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash.

Statement: This issue did not affect the versions of php and php53 as shipped with Red Hat Enterprise Linux 5, and the versions of php as shipped with Red Hat Enterprise Linux 7.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
onbeforeunload and Javascript navigation DOS (MFSA 2014-20)
CVE: CVE-2014-1500
Component: Mozilla
Severity: Moderate
Release date: 2014-03-18T00:00:00+00:00

Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution.

Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6

Remediation:
assert failure when processing wrapped strings
CVE: CVE-2014-9130
Component: libyaml
CWE: CWE-617
Severity: Moderate
Release date: 2014-11-26T00:00:00+00:00

An assertion failure was found in the way the libyaml library parsed wrapped strings. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
check_icmp Arbitrary Option File Read
CVE: CVE-2014-4702
Component: nagios-plugins
Severity: Important
Release date: 2014-05-16T00:00:00+00:00

The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4701.

Statement: This issue did not affect the versions of nagios-plugins as shipped with Red Hat Enterprise Linux OpenStack Platform.

Remediation:
XSS in Swift requests through WWW-Authenticate header
CVE: CVE-2014-3497
Component: openstack-swift
CWE: CWE-79
Severity: Moderate
Release date: 2014-06-19T00:00:00+00:00

It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks (and possibly other impacts) if a user were tricked into clicking on a malicious URL.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
heap overflow in psd file
CVE: CVE-2014-9833
Component: ImageMagick
CWE: CWE-122
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

Heap overflow in ImageMagick 6.8.9-9 via a crafted psd file.


Remediation:
cookie processing stack overflow (AST-2014-001)
CVE: CVE-2014-2286
Component: asterisk
Release date: 2014-02-14T00:00:00+00:00

main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
/api/... XSS vulnerability
CVE: CVE-2014-9649
Component: RabbitMQ
CWE: CWE-79
Severity: Moderate
Release date: 2014-10-29T00:00:00+00:00

A cross-site scripting vulnerability was discovered in RabbitMQ, which allowed using api/ path info to inject and receive data. A remote attacker could use this flaw to create an "/api/..." URL, forcing a server error that resulted in the server returning an HTML page with embedded text from the URL (not escaped).


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
XSS vulnerability in redirection mechanism
CVE: CVE-2014-9219
Component: phpMyAdmin
Release date: 2014-12-03T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
multiple flaws fixed in upstream 2.1.1
CVE: CVE-2014-2906
Component: fish
Release date: 2014-04-28T00:00:00+00:00

The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libceph auth token buffer overflow
CVE: CVE-2014-6416
Component: kernel
Severity: Important
Release date: 2014-09-15T00:00:00+00:00

Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket.

Statement: This issue did not affect the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 (as they did not include support for this feature).

Remediation:
provisioning templates are world accessible
CVE: CVE-2014-0192
Component: Foreman
CWE: CWE-305
Severity: Moderate
Release date: 2014-04-25T00:00:00+00:00

Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Subscription Manageemnt.
Details on how to use Red Hat Subscription Management are available at
https://access.redhat.com/articles/433903.
Insecure use of temporary file
CVE: CVE-2014-4978
Component: rawstudio
Release date: 2014-07-15T00:00:00+00:00

The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
3.4+ arbitrary write with CONFIG_X86_X32
CVE: CVE-2014-0038
Component: Kernel
Severity: Important
Release date: 2014-01-31T00:00:00+00:00

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.

Statement: Not vulnerable. This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

Remediation:
multiple issues
CVE: CVE-2014-0487
Component: apt
Release date: 2014-09-16T00:00:00+00:00

APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
security issues fixed in the upstream 2.7.1, 2.6.4, 2.5.7, and 2.4.11 releases
CVE: CVE-2014-3546
Component: moodle
Release date: 2014-07-14T00:00:00+00:00

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php and (2) user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a modified URL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
memory leak in quantum management
CVE: CVE-2014-9848
Component: ImageMagick
Severity: Moderate
Release date: 2014-12-24T00:00:00+00:00

Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption).


Remediation:
xen: Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation (XSA-105)
CVE: CVE-2014-7155
Component: kernel
CWE: CWE-862
Severity: Important
Release date: 2014-09-23T00:00:00+00:00

The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.

Statement: Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

Remediation:
remote command injection in cups-browsed
CVE: CVE-2014-2707
Component: cups-filters
Severity: Important
Release date: 2014-04-01T00:00:00+00:00

cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."

Statement: Not vulnerable. This issue did not affect the versions of cups-filters as shipped with Red Hat Enterprise Linux 7.

Remediation:
XMLBuilder2 is vulnerable to XML External Entity (XXE) injection
CVE: CVE-2014-125087
Component: java-xmlbuilder
CWE: CWE-611
Severity: Critical
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2014-01-01T00:00:00+00:00

A flaw was found in java-xmlbuilder. The manipulation leads to an XML external entity (XXE) reference.


Remediation:
unspecified vulnerability fixed in 7u51 (Install)
CVE: CVE-2014-0385
Component: JDK
Severity: Critical
Release date: 2014-01-14T00:00:00+00:00

Unspecified vulnerability in Oracle Java SE 7u45, when installing on OS X, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.

Statement: Not vulnerable. This issue did not affect the versions of Oracle JDK as shipped with Red Hat Enterprise Linux 5 and 6.

Remediation:
Misinterpreted return value of snprintf function
CVE: CVE-2014-7913
Component: dhcpcd
Release date: 2014-01-01T00:00:00+00:00

The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted message.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: