huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2015-3239: libunwind: off-by-one in dwarf_to_unw_regnum()
Component: libunwind
Severity: Low
CWE: CWE-193 (Off-by-one Error)
Public date: 2015-06-20T00:00:00+00:00

An off-by-one array indexing error was found in the libunwind API, which could cause an error when reading untrusted binaries or dwarf debug info data. Red Hat products do not call the API in this way; and it is unlikely that any exploitable attack vector exists in current builds or supported usage.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/libunwind.git
Upstream fix commit: 396b6c7ab737e2bff244d640601c436a26260ca1
CVE-2015-3281: haproxy: information leak in buffer_slow_realign()
Component: haproxy
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2015-07-07T00:00:00+00:00

An implementation error related to the memory management of request and responses was found within HAProxy's buffer_slow_realign() function. An unauthenticated remote attacker could possibly use this flaw to leak certain memory buffer contents from a past request or session.


Affected upstream versions: n/a
Fixed upstream versions: v1.5.14
Upstream repository: https://git.haproxy.org/haproxy-1.5.git
Upstream fix commit: 7ec765568883b2d4e5a2796adbeb492a22ec9bd4
CVE-2015-3288: kernel: zero page memory arbitrary modification
Component: kernel
Severity: Low
CWE: CWE-391 (Unchecked Error Condition)
Public date: 2015-07-06T00:00:00+00:00

mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6b7339f4c31ad69c8e9c0b2859276e22cf72176d
CVE-2015-3315: abrt: Various race-conditions and symlink issues found in abrt
Component: abrt
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
Public date: 2015-04-14T00:00:00+00:00

It was found that ABRT was vulnerable to multiple race condition and symbolic link flaws. A local attacker could use either of these flaws to potentially escalate their privileges on the system.

Statement: This issue affects the versions of the abrt package as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: 2.1.11-20.el7
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: 80408e9e24a1c10f85fd969e1853e0f192157f92
CVE-2015-3329: php: buffer overflow in phar_set_inode()
Component: php
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2015-04-16T00:00:00+00:00

A buffer overflow flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: f59b67ae50064560d7bfcdb0d6a8ab284179053c
CVE-2015-3330: php: pipelined request executed in deinitialized interpreter under httpd 2.4
Component: php
Severity: Important
CWE: CWE-665 (Improper Initialization)
Public date: 2015-04-16T00:00:00+00:00

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.

Statement: This issue did not affect PHP packages as shipped with Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 809610f5ea38a83b284e1125d1fff129bdd615e7
CVE-2015-3331: Kernel: crypto: buffer overruns in RFC4106 implementation using AESNI
Component: Kernel
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
Public date: 2015-03-12T00:00:00+00:00

A buffer overflow flaw was found in the way the Linux kernel's Intel AES-NI instructions optimized version of the RFC4106 GCM mode decryption functionality handled fragmented packets. A remote attacker could use this flaw to crash, or potentially escalate their privileges on, a system over a connection with an active AES-GCM mode IPSec security association.

Statement: This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5.

This issue affects the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates
for Red Hat Enterprise Linux 6 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ccfe8c3f7e52ae83155cb038753f4c75b774ca8a
CVE-2015-3339: kernel: race condition between chown() and execve()
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
Public date: 2015-04-20T00:00:00+00:00

A race condition flaw was found between the chown and execve system calls. When changing the owner of a setuid user binary to root, the race condition could momentarily make the binary setuid root. A local, unprivileged user could potentially use this flaw to escalate their privileges on the system.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 7 and MRG-2. This issue is not currently planned to be addressed in future Red Hat Enterprise Linux 5 kernel updates.  Future Linux kernel updates for other releases may address this issue.

For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.1
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
CVE-2015-3411: php: missing null byte checks for paths in various PHP extensions
Component: php
Severity: Moderate
CWE: CWE-626 (Null Byte Interaction Error (Poison Null Byte))
Public date: 2015-04-16T00:00:00+00:00

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 4435b9142ff9813845d5c97ab29a5d637bedb257
CVE-2015-3412: php: missing null byte checks for paths in various PHP extensions
Component: php
Severity: Moderate
CWE: CWE-626 (Null Byte Interaction Error (Poison Null Byte))
Public date: 2015-04-16T00:00:00+00:00

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 4435b9142ff9813845d5c97ab29a5d637bedb257
CVE-2015-3418: xorg-x11-server: divide-by-zero when checking image dimensions
Component: xorg-x11-server
Severity: Low
CWE: CWE-369 (Divide By Zero)
Public date: 2015-04-24T00:00:00+00:00

A divide-by-zero flaw was found in the way the X.Org server checked the dimensions of certain images. An attacker could potentially crash the X.Org server by tricking a suitable X application into displaying a specially crafted image file.


Affected upstream versions: n/a
Fixed upstream versions: xorg-server-1.16.99.902
Upstream repository: https://cgit.freedesktop.org/xorg/xserver
Upstream fix commit: dc777c346d5d452a53b13b917c45f6a1bad2f20b
CVE-2015-3456: qemu: fdc: out-of-bounds fifo buffer memory access
Component: qemu
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2015-05-13T00:00:00+00:00

An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.

Statement: This issue affects the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6 and 7, and the versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases will address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.4.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: e907746266721f305d67bc0718795fedee2e824c
CVE-2015-3636: kernel: ping sockets: use-after-free leading to local privilege escalation
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2015-05-02T00:00:00+00:00

It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system.

Statement: This issue does not affect the Linux kernel as shipped with Red Hat Enterprise Linux 5. This issue does affect the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases will address this issue.

Please note that on x86-64 architecture systems the impact is limited to local Denial of Service and that the ping sockets functionality is disabled by default (net.ipv4.ping_group_range sysctl is "1	0").

Affected upstream versions: n/a
Fixed upstream versions: v4.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a134f083e79fb4c3d0a925691e732c56911b4326
CVE-2015-3810: wireshark: WebSocket DoS (wnpa-sec-2015-13)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-05-12T00:00:00+00:00

epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 4ee6bcbd2e03a25f1e6b0239558d9edeaf8040c0
CVE-2015-3811: wireshark: WCP dissector crash (wnpa-sec-2015-14)
Component: wireshark
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
Public date: 2015-05-12T00:00:00+00:00

A flaw was found in WCP dissector of wireshark of which an attacker could crash wireshark by injecting a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: a6fc6aa0b4efc1a1c3d7a2e3b5189e888fb6ccc2
CVE-2015-3812: wireshark: X11 memory leak (wnpa-sec-2015-15)
Component: wireshark
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
Public date: 2015-05-12T00:00:00+00:00

A flaw was found in X11 dissector of wireshark of which an attacker could make wireshark consume excessive CPU resources which could make system unresponsive by injecting specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: b8ccc2a6add29823a0ff0492fc50372449007e7b
CVE-2015-3813: wireshark: Reassembly memory leak (wnpa-sec-2015-16)
Component: wireshark
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
Public date: 2015-05-12T00:00:00+00:00

A flaw was found in the way packet reassembly code of wireshark would parse a packet which could leak memory. An attacker could use this flaw to crash wireshark by sending a specially crafted packet onto the wire or by convincing wireshark user to read malformed packet trace file.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: c35f2ccb4433718416551cc7a85afb0860529d57
CVE-2015-4170: kernel: pty layer race condition on tty ldisc shutdown.
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
Public date: 2015-01-19T00:00:00+00:00

A flaw was discovered in the way the Linux kernel's TTY subsystem handled the tty shutdown phase. A local, unprivileged user could use this flaw to cause denial of service on the system by holding a reference to the ldisc lock during tty shutdown, causing a deadlock.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 5, 6.

This issue affects the Linux kernel packages kernel as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cf872776fc84128bb779ce2b83a37c884c3203ae
CVE-2015-4335: redis: Lua sandbox escape and arbitrary code execution
Component: redis
Severity: Important
Public date: 2015-06-04T00:00:00+00:00

A flaw was discovered in redis that could allow an authenticated user, who was able to use the EVAL command to run Lua code, to break out of the Lua sandbox and execute arbitrary code on the system.


Affected upstream versions: n/a
Upstream repository: https://github.com/antirez/redis
Upstream fix commit: fdf9d455098f54f7666c702ae464e6ea21e25411
CVE-2015-4491: Mozilla: Heap overflow in gdk-pixbuf when scaling bitmap images (MFSA 2015-88)
Component: Mozilla
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2015-08-11T00:00:00+00:00

An integer overflow, leading to a heap-based buffer overflow, was found in the way gdk-pixbuf, an image loading library for GNOME, scaled certain bitmap format images. An attacker could use a specially crafted BMP image file that, when processed by an application compiled against the gdk-pixbuf library, would cause that application to crash or execute arbitrary code with the permissions of the user running the application.

Statement: This issue did not affect the versions of gdk-pixbuf as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: 2.31.5
Upstream repository: https://git.gnome.org/browse/gdk-pixbuf
Upstream fix commit: ffec86ed5010c5a2be14f47b33bcf4ed3169a199
CVE-2015-4493: Mozilla: Overflow issues in libstagefright (MFSA 2015-83)
Component: Mozilla
Severity: Critical
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2015-08-11T00:00:00+00:00

Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/mozilla-central
Upstream fix commit: a674c7019cb5
CVE-2015-4496: Mozilla: Integer overflows in libstagefright while processing MP4 video metadata (MFSA 2015-93)
Component: Mozilla
Severity: Critical
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2015-08-12T00:00:00+00:00

Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file, a related issue to CVE-2015-1538.


Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/mozilla-central
Upstream fix commit: 87277085561a
CVE-2015-4599: php: type confusion issue in unserialize() with various SOAP methods
Component: php
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
Public date: 2015-04-16T00:00:00+00:00

Multiple flaws were discovered in the way PHP's Soap extension performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to disclose portion of its memory or crash.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 51856a76f87ecb24fe1385342be43610fb6c86e4
CVE-2015-4600: php: type confusion issue in unserialize() with various SOAP methods
Component: php
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
Public date: 2015-04-16T00:00:00+00:00

Multiple flaws were discovered in the way PHP's Soap extension performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to disclose portion of its memory or crash.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.39
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 0c136a2abd49298b66acb0cad504f0f972f5bfe8
CVE-2015-4601: php: type confusion issue in unserialize() with various SOAP methods
Component: php
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
Public date: 2015-04-16T00:00:00+00:00

Multiple flaws were discovered in the way PHP's Soap extension performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to disclose portion of its memory or crash.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.39
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 0c136a2abd49298b66acb0cad504f0f972f5bfe8
CVE-2015-4602: php: Incomplete Class unserialization type confusion
Component: php
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
Public date: 2015-03-20T00:00:00+00:00

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: fb83c76deec58f1fab17c350f04c9f042e5977d1
CVE-2015-4604: php: denial of service when processing a crafted file with Fileinfo
Component: php
Severity: Moderate
Public date: 2015-04-16T00:00:00+00:00

The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: f938112c495b0d26572435c0be73ac0bfe642ecd
CVE-2015-4605: php: denial of service when processing a crafted file with Fileinfo
Component: php
Severity: Moderate
Public date: 2015-04-16T00:00:00+00:00

The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.40
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: f938112c495b0d26572435c0be73ac0bfe642ecd
CVE-2015-4643: php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)
Component: php
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2015-06-11T00:00:00+00:00

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.42
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 0765623d6991b62ffcd93ddb6be8a5203a2fa7e2
CVE-2015-4644: php: NULL pointer dereference in php_pgsql_meta_data()
Component: php
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-06-11T00:00:00+00:00

The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token extraction for table names, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1352.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not planned to be corrected in future updates for php packages in Red Hat Enterprise Linux 6 and 7, and php53 packages in Red Hat Enterprise Linux 5. The php packages in Red Hat Enterprise Linux 5 were not affected by this issue.

Affected upstream versions: n/a
Fixed upstream versions: php-5.5.26
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 2cc4e69cc6d8dbc4b3568ad3dd583324a7c11d64
CVE-2015-4700: kernel: Crafted BPF filters may crash kernel during JIT optimisation
Component: kernel
Severity: Important
CWE: CWE-665 (Improper Initialization)
Public date: 2015-06-23T00:00:00+00:00

A flaw was found in the kernel's implementation of the Berkeley Packet Filter (BPF). A local attacker could craft BPF code to crash the system by creating a situation in which the JIT compiler would fail to correctly optimize the JIT image on the last pass. This would lead to the CPU executing instructions that were not part of the JIT code.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6 as it does not contain the affected code. This does not affect the Red Hat Enterprise MRG 2 as it does not enable the affected code at compile time.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: v4.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3f7352bf21f8fd7ba3e2fcef9488756f188e12be