huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-10159: php: Integer overflow in phar_parse_pharfile
Component: php
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-01-19T00:00:00+00:00

Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.30
Upstream repository: https://github.com/php/php-src
Upstream fix commit: ca46d0acbce55019b970fcd4c1e8a10edfdded93
CVE-2016-10160: php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive
Component: php
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-01-19T00:00:00+00:00

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.30
Upstream repository: https://github.com/php/php-src
Upstream fix commit: b28b8b2fee6dfa6fcd13305c581bb835689ac3be
CVE-2016-10161: php: Out-of-bounds heap read on unserialize in finish_nested_data()
Component: php
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-01-19T00:00:00+00:00

The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.30
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 16b3003ffc6393e250f069aa28a78dc5a2c064b2
CVE-2016-10162: php: Null pointer dereference when unserializing PHP object
Component: php
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-01-19T00:00:00+00:00

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.


Affected upstream versions: n/a
Fixed upstream versions: php-7.0.15
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 8d2539fa0faf3f63e1d1e7635347c5b9e777d47b
CVE-2016-10164: libXpm: Out-of-bounds write in XPM extension parsing
Component: libXpm
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.8 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L)
Public date: 2016-12-12T00:00:00+00:00

An integer overflow flaw leading to a heap-based buffer overflow was found in libXpm. An attacker could use this flaw to crash an application using libXpm via a specially crafted XPM file.


Affected upstream versions: n/a
Fixed upstream versions: libXpm-3.5.12
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libXpm
Upstream fix commit: d1167418f0fd02a27f617ec5afd6db053afbe185
CVE-2016-10165: lcms2: Out-of-bounds read in Type_MLU_Read()
Component: lcms2
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Public date: 2016-08-15T00:00:00+00:00

The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.


Affected upstream versions: n/a
Fixed upstream versions: lcms2.9
Upstream repository: https://github.com/mm2/Little-CMS
Upstream fix commit: 5ca71a7bc18b6897ab21d815d15e218e204581e2
CVE-2016-10166: gd: Unsigned integer underflow _gdContributionsAlloc()
Component: gd
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2016-08-06T00:00:00+00:00

Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.


Affected upstream versions: n/a
Fixed upstream versions: gd-2.3.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: 60bfb401ad5a4a8ae995dcd36372fe15c71e1a35
CVE-2016-10167: gd: DoS vulnerability in gdImageCreateFromGd2Ctx()
Component: gd
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-08-16T00:00:00+00:00

A null pointer dereference flaw was found in libgd. An attacker could use a specially-crafted .gd2 file to cause an application linked with libgd to crash, leading to denial of service.


Affected upstream versions: n/a
Fixed upstream versions: gd-2.3.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: fe9ed49dafa993e3af96b6a5a589efeea9bfb36f
CVE-2016-10168: gd: Integer overflow in gd_io.c
Component: gd
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2016-12-17T00:00:00+00:00

An integer overflow flaw, leading to a heap-based buffer overflow was found in the way libgd read some specially-crafted gd2 files. A remote attacker could use this flaw to crash an application compiled with libgd or in certain cases execute arbitrary code with the privileges of the user running that application.


Affected upstream versions: n/a
Fixed upstream versions: gd-2.3.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: 69d2fd2c597ffc0c217de1238b9bf4d4bceba8e6
CVE-2016-10195: libevent: Stack-buffer overflow in the name_parse() function
Component: libevent
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-01-27T00:00:00+00:00

A vulnerability was found in libevent with the parsing of DNS requests and replies.  An attacker could send a forged DNS response to an application using libevent which could lead to reading data out of bounds on the heap, potentially disclosing a small amount of application memory.


Affected upstream versions: n/a
Fixed upstream versions: release-2.1.8-stable
Upstream repository: https://github.com/libevent/libevent
Upstream fix commit: 96f64a022014a208105ead6c8a7066018449d86d
CVE-2016-10196: libevent: Stack-buffer overflow in evutil_parse_sockaddr_port()
Component: libevent
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-01-27T00:00:00+00:00

A vulnerability was found in libevent with the parsing of IPv6 addresses. If an attacker could cause an application using libevent to parse a malformed address in IPv6 notation of more than 2GiB in length, a stack overflow would occur leading to a crash.


Affected upstream versions: n/a
Fixed upstream versions: release-2.1.8-stable
Upstream repository: https://github.com/libevent/libevent
Upstream fix commit: 329acc18a0768c21ba22522f01a5c7f46cacc4d5
CVE-2016-10197: libevent: Out-of-bounds read in search_make_new()
Component: libevent
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-03-03T00:00:00+00:00

An out of bounds read vulnerability was found in libevent in the search_make_new function.  If an attacker could cause an application using libevent to attempt resolving an empty hostname, an out of bounds read could occur possibly leading to a crash.


Affected upstream versions: n/a
Fixed upstream versions: release-2.1.8-stable
Upstream repository: https://github.com/libevent/libevent
Upstream fix commit: ec65c42052d95d2c23d1d837136d1cf1d9ecef9e
CVE-2016-10200: kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-11-18T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2.  Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 32c231164b762dddefa13af5a0101032c70b50ef
CVE-2016-10207: tigervnc: VNC server can crash when TLS handshake terminates early
Component: tigervnc
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-08-23T00:00:00+00:00

A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early.


Affected upstream versions: n/a
Fixed upstream versions: v1.7.90
Upstream repository: https://github.com/TigerVNC/tigervnc
Upstream fix commit: 8aa4bc53206c2430bbf0c8f4b642f59a379ee649
CVE-2016-10208: kernel: EXT4 memory corruption / SLAB out-of-bounds read
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-11-15T00:00:00+00:00

Mounting a crafted EXT4 image read-only leads to an attacker controlled memory corruption and SLAB-Out-of-Bounds reads.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7, MRG-2 and realtime kernels. This has been rated as having Moderate security impact and is currently planned to be addressed in future updates.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3a4b77cd47bb837b8557595ec7425f281f2ca1fe
CVE-2016-10245: doxygen: cross-site scripting in templates/html/search_opensearch.php
Component: doxygen
Severity: Low
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2019-05-24T00:00:00+00:00

Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.

Statement: * This issue did not affect the versions of doxygen as shipped with Red Hat Enterprise Linux 5, and 6 as they did not include the vulnerable file search_opensearch.php.
* This issue did not affect the versions of doxygen as shipped with Red Hat Enterprise Linux 8 as they already include the patched code.

Affected upstream versions: n/a
Fixed upstream versions: Release_1_8_12
Upstream repository: https://github.com/doxygen/doxygen
Upstream fix commit: 1cc1adad2de03a0f013881b8960daf89aa155081
CVE-2016-10248: jasper: NULL pointer dereference in jpc_tsfb_synthesize()
Component: jasper
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-20T00:00:00+00:00

The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 2e82fa00466ae525339754bb3ab0a0474a31d4bd
CVE-2016-10249: jasper: integer overflow in jas_matrix_create()
Component: jasper
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-10-23T00:00:00+00:00

Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 988f8365f7d8ad8073b6786e433d34c553ecf568
CVE-2016-10251: jasper: integer overflow in jpc_pi_nextcprl(), leading to out-of-bounds read
Component: jasper
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-11-04T00:00:00+00:00

Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 1f0dfe5a42911b6880a1445f13f6d615ddb55387
CVE-2016-10708: openssh: Out of sequence NEWKEYS message can allow remote attacker to cause denial of service
Component: openssh
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-01-24T00:00:00+00:00

sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.

Statement: This issue affects the versions of openssh as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7 (versions 7.3 and earlier).  For Red Hat Enterprise Linux 7 (versions 7.4 and later), this issue was fixed by the Security Advisory RHSA-2017:2029. For Red Hat Enterprise Linux 6, Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: V_7_4_P1
Upstream repository: https://anongit.mindrot.org/openssh.git
Upstream fix commit: 28652bca29046f62c7045e933e6b931de1d16737
CVE-2016-10713: patch: Out-of-bounds access in pch_write_line function in pch.c
Component: patch
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-02-13T00:00:00+00:00

A heap-based out-of-bounds read flaw was found in the way the patch utility parsed patch files. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patch files.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/patch.git/commit/src/pch.c
Upstream fix commit: a0d7fe4589651c64bd16ddaaa634030bb0455866
CVE-2016-10727: evolution-data-server: IMAPx Component Information Disclosure
Component: evolution-data-server
Severity: Moderate
CWE: CWE-319 (Cleartext Transmission of Sensitive Information)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2016-05-10T00:00:00+00:00

camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.

Statement: This issue did not affect the versions of evolution-data-server as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include the vulnerable code.

Affected upstream versions: n/a
Fixed upstream versions: EVOLUTION_DATA_SERVER_3_21_2
Upstream repository: https://gitlab.gnome.org/GNOME/evolution-data-server
Upstream fix commit: f26a6f67
CVE-2016-10741: kernel: race condition between direct and memory-mapped I/O in fs/xfs/xfs_aops.c
Component: kernel
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-11-08T00:00:00+00:00

It was found that the Linux kernel can hit a BUG_ON() statement in the __xfs_get_blocks() in the fs/xfs/xfs_aops.c because of a race condition between direct and memory-mapped I/O associated with a hole in a file that is handled with BUG_ON() instead of an I/O failure. This allows a local unprivileged attacker to cause a system crash and a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 04197b341f23b908193308b8d63d17ff23232598
CVE-2016-10745: python-jinja2: Sandbox escape due to information disclosure via str.format
Component: python-jinja2
Severity: Important
CWE: CWE-138 (Improper Neutralization of Special Elements)
CVSS v3: 9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2016-12-29T00:00:00+00:00

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity as well as system integrity.

Statement: * Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed.
* Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package.
* Red Hat Update Infrastructure is not affected because its packaged versions of python-jinja2 do not use the Sandbox feature, nor does it allow untrusted jinja2 templates.
* Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable.
* Red Hat Ceph Storage 2 and 3 are affected by this flaw as it contains the vulnerable code and will get security fixes for python-jinja2 from Red Hat Enterprise Linux 7 channel.

Affected upstream versions: n/a
Fixed upstream versions: 2.8.1
Upstream repository: https://github.com/pallets/jinja
Upstream fix commit: 9b53045c34e61013dc8f09b7e52a555fa16bed16
CVE-2016-1245: quagga: Buffer Overflow in IPv6 RA handling
Component: quagga
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-10-18T00:00:00+00:00

A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service.


Affected upstream versions: Quagga before 1.0.20161017
Fixed upstream versions: quagga-1.1.0
Upstream repository: https://github.com/Quagga/quagga
Upstream fix commit: cfb1fae25f8c092e0d17073eaf7bd428ce1cd546
CVE-2016-1248: vim: Lack of validation of values for few options results in code exection
Component: vim
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-11-20T00:00:00+00:00

A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim.


Affected upstream versions: vim before patch 8.0.0056
Fixed upstream versions: v8.0.0056
Upstream repository: https://github.com/vim/vim
Upstream fix commit: d0b5138ba4bccff8a744c99836041ef6322ed39a
CVE-2016-1541: libarchive: zip_read_mac_metadata() heap-based buffer overflow
Component: libarchive
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 8.4 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L)
Public date: 2016-05-02T00:00:00+00:00

A vulnerability was found in libarchive. A specially crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the application.


Affected upstream versions: n/a
Fixed upstream versions: v3.2.0
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7
CVE-2016-1568: Qemu: ide: ahci use-after-free vulnerability in aio port commands
Component: Qemu
Severity: Low
CWE: CWE-416 (Use After Free)
Public date: 2016-01-08T00:00:00+00:00

A use-after-free flaw was found in the way QEMU's IDE AHCI emulator processed certain AHCI Native Command Queuing (NCQ) AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Statement: The vector of exploit requires to enable TIOCSTI with sysctl, because it
is by default disabled since RHEL9 and on. Then, the user would have to
be in root terminal, from there the user would have to run a malicious
app that would use TIOCSTI to jump out of the child non-root shell back
to the parent root shell.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 4ab0359a8ae182a7ac5c99609667273167703fab
CVE-2016-1583: kernel: Stack overflow via ecryptfs and /proc/$pid/environ
Component: kernel
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 8.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2016-06-10T00:00:00+00:00

It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.

Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6 and may addressed in a future update.

Affected upstream versions: n/a
Fixed upstream versions: v4.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f5364c150aa645b3d7daa21b5c0b9feaa1c9cd6d
CVE-2016-1683: chromium-browser: out-of-bounds access in libxslt
Component: chromium-browser
Severity: Moderate
Public date: 2016-05-25T00:00:00+00:00

numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial of service (out-of-bounds heap memory access) or possibly have unspecified other impact via a crafted document.


Affected upstream versions: n/a
Fixed upstream versions: v1.1.29
Upstream repository: https://git.gnome.org/browse/libxslt
Upstream fix commit: d182d8f6ba3071503d96ce17395c9d55871f0242
CVE-2016-1684: chromium-browser: integer overflow in libxslt
Component: chromium-browser
Severity: Moderate
Public date: 2016-05-25T00:00:00+00:00

numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.


Affected upstream versions: n/a
Fixed upstream versions: v1.1.29
Upstream repository: https://git.gnome.org/browse/libxslt
Upstream fix commit: 91d0540ac9beaa86719a05b749219a69baa0dd8d