huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-5806: LibRaw: NULL pointer dereference in leaf_hdr_load_raw() function in internal/dcraw_common.cpp
Component: LibRaw
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-03-14T00:00:00+00:00

A NULL pointer dereference vulnerability in internal/dcraw_common.cpp:leaf_hdr_load_raw() function was found in LibRaw. A user can cause a denial of service when processing specially-crafted RAW data.

Statement: This issue did not affect the versions of dcraw as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include the vulnerable code.

This issue did not affect the versions of LibRaw as shipped with Red Hat Enterprise Linux 7 as they did not include the vulnerable code.

Affected upstream versions: Prior to 0.18.8
Fixed upstream versions: 0.18.8
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: 9f26ce37f5be86ea11bfc6831366558650b1f6ff
CVE-2018-6560: flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake
Component: flatpak
Severity: Moderate
CWE: CWE-270 (Privilege Context Switching Error)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L)
Public date: 2018-01-29T00:00:00+00:00

It was found that flatpak's D-Bus proxy did not properly filter the access to D-Bus during the authentication protocol. A specially crafted flatpak application could use this flaw to bypass all restrictions imposed by flatpak and have full access to the D-BUS interface.


Affected upstream versions: n/a
Fixed upstream versions: 0.11.1
Upstream repository: https://github.com/flatpak/flatpak
Upstream fix commit: 52346bf187b5a7f1c0fe9075b328b7ad6abe78f6
CVE-2018-6790: kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element
Component: kde-workspace
Severity: Low
CWE: CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2018-02-08T00:00:00+00:00

An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element.


Affected upstream versions: n/a
Upstream repository: https://cgit.kde.org/plasma-workspace.git
Upstream fix commit: 5bc696b5abcdb460c1017592e80b2d7f6ed3107c
CVE-2018-6871: libreoffice: Remote arbitrary file disclosure vulnerability via WEBSERVICE formula
Component: libreoffice
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2018-02-12T00:00:00+00:00

A flaw was found in libreoffice before 5.4.5 and before 6.0.1. Arbitrary remote file disclosure may be achieved by the use of the WEBSERVICE formula in a specially crafted ODS file.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/libreoffice/core
Upstream fix commit: a916fc0c0e0e8b10cb4158fa0fa173fe205d434a
CVE-2018-6927: kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact
Component: kernel
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-02-12T00:00:00+00:00

The futex_requeue function in kernel/futex.c in the Linux kernel, before 4.14.15, might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified other impacts by triggering a negative wake or requeue value. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This is not currently planned to be addressed in future updates of the product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fbe0e839d1e22d88810f3ee3e2f1479be4c0aa4a
CVE-2018-7191: kernel: denial of service via ioctl call in network tun handling
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-01-17T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service (NULL pointer dereference and panic) via an ioctl (TUNSETIFF) call with a dev name containing a / character.


Affected upstream versions: n/a
Fixed upstream versions: v4.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 0ad646c81b2182f7fa67ec0c8c825e0ee165696d
CVE-2018-7418: wireshark: SIGCOMP dissector crash in packet-sigcomp.c
Component: wireshark
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-02-11T00:00:00+00:00

A denial of service flaw was found in the SIGCOMP dissector in Wireshark. A remote network attacker could potentially use this flaw to crash Wireshark by tricking it into processing a crafted packet.


Affected upstream versions: n/a
Fixed upstream versions: v2.4.5
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 29d920b8309905dda11ad397596fe8aafc9b4bf7
CVE-2018-7456: libtiff: NULL pointer dereference in tif_print.c:TIFFPrintDirectory() causes a denial of service
Component: libtiff
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-02-24T00:00:00+00:00

A NULL Pointer Dereference occurs in the function TIFFPrintDirectory in tif_print.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 when using the tiffinfo tool to print crafted TIFF information, a different vulnerability than CVE-2017-18013. (This affects an earlier part of the TIFFPrintDirectory function that was not addressed by the CVE-2017-18013 patch.)


Affected upstream versions: n/a
Fixed upstream versions: v4.0.10
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: be4c85b16e8801a16eec25e80eb9f3dd6a96731b
CVE-2018-7485: unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c
Component: unixODBC
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.8 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2018-02-27T00:00:00+00:00

An argument order confusion flaw was found in the SQLWriteFileDSN API of unixODBC. This could only be exploited via a malicious ODBC database connector package with the maximum impact being a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: 2.3.6
Upstream repository: https://github.com/lurcher/unixODBC
Upstream fix commit: 45ef78e037f578b15fc58938a3a3251655e71d6f
CVE-2018-7536: django: Catastrophic backtracking in regular expressions via 'urlize' and 'urlizetrunc'
Component: django
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-03-06T00:00:00+00:00

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.

Statement: This issue affects the versions of django as shipped with Red Hat Subscription Asset Manager. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: stable/1.8.x
Upstream repository: https://github.com/django/django
Upstream fix commit: 1ca63a66ef3163149ad822701273e8a1844192c2
CVE-2018-7566: kernel: race condition in snd_seq_write() may lead to UAF or OOB-access
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-02-14T00:00:00+00:00

ALSA sequencer core initializes the event pool on demand by invoking snd_seq_pool_init() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: d15d662e89fc667b90cd294b0eb45694e33144da
CVE-2018-7584: php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response
Component: php
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-02-20T00:00:00+00:00

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.34
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 523f230c831d7b33353203fa34aee4e92ac12bba
CVE-2018-7642: binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash
Component: binutils
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-02-24T00:00:00+00:00

The swap_std_reloc_in function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout_32_swap_std_reloc_out NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.


Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 116acb2c268c89c89186673a7c92620d21825b25
CVE-2018-7730: exempi: Heap-based buffer overflow in PSD_MetaHandler::CacheFileData function in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp allows for denial of service via crafted XLS file
Component: exempi
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-02-22T00:00:00+00:00

An integer wraparound, leading to a buffer overflow, was found in Exempi in the way it handles Adobe Photoshop Images. An attacker could exploit this to cause a denial of service via a crafted image file.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/exempi
Upstream fix commit: 6cbd34025e5fd3ba47b29b602096e456507ce83b
CVE-2018-7750: python-paramiko: Authentication bypass in transport.py
Component: python-paramiko
Severity: Critical
CWE: CWE-287 (Improper Authentication)
CVSS v3: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-03-13T00:00:00+00:00

It was found that when acting as an SSH server, paramiko did not properly check whether authentication is completed before processing other requests. A customized SSH client could use this to bypass authentication when accessing any resources controlled by paramiko.

Statement: This flaw is a user authentication bypass in the SSH Server functionality of paramiko (normally used by subclassing `paramiko.ServerInterface`). Where paramiko is used only for its client-side functionality (e.g. `paramiko.SSHClient`), the vulnerability is not exposed and thus cannot be exploited.

The following Red Hat products use paramiko only in client-side mode. Server side functionality is not used.

* Red Hat Ceph Storage 2
* Red Hat CloudForms 4
* Red Hat Enterprise Linux 7
* Red Hat Enterprise Virtualization
* Red Hat Gluster Storage 3
* Red Hat Openshift Container Platform
* Red Hat Quick Cloud Installer
* Red Hat Satellite 6
* Red Hat Storage Console 2
* Red Hat OpenStack Platform
* Red Hat Update Infrastructure

Affected upstream versions: n/a
Fixed upstream versions: 2.0.8
Upstream repository: https://github.com/paramiko/paramiko
Upstream fix commit: fa29bd8446c8eab237f5187d28787727b4610516
CVE-2018-7757: kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c
Component: kernel
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-03-08T00:00:00+00:00

Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel allows local users to cause a denial of service (kernel memory exhaustion) via multiple read accesses to files in the /sys/class/sas_phy directory.


Affected upstream versions: n/a
Fixed upstream versions: v4.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 4a491b1ab11ca0556d2fda1ff1301e862a2d44c4
CVE-2018-8039: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*
Component: apache-cxf
Severity: Important
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2018-06-29T00:00:00+00:00

It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in the reflection code but it is not properly propagated, this can lead to a man-in-the-middle attack.

Statement: In OpenShift Logging the openshift-logging/elasticsearch6-rhel8 container bundles the vulnerable version of apache-cxf, but the vulnerable class is not shipped, hence this component is not affected by this vulnerability.

Affected upstream versions: prior to 3.1.16, 3.2.x prior to 3.2.5
Fixed upstream versions: cxf-3.2.5
Upstream repository: https://github.com/apache/cxf
Upstream fix commit: fae6fabf9bd7647f5e9cb68897a7d72b545b741b
CVE-2018-8087: kernel: Memory leak in drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() can lead to potential denial of service
Component: kernel
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-01-18T00:00:00+00:00

The Linux kernel is vulnerable to a memory leak in the drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() function. An attacker could exploit this to cause a potential denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v4.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 0ddcff49b672239dda94d70d0fcf50317a9f4b51
CVE-2018-8088: slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
Component: slf4j
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-02-22T00:00:00+00:00

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution.

Statement: Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates.

This issue did not affect the versions of Candlepin as shipped with Red Hat Satellite 6 as Candlepin uses slf4j-api and not the affected slf4j-ext (which is not on the Candlepin classpath).

Red Hat Enterprise Virtualization Manager 4.1 is affected by this issue. Updated packages that address this issue are available through the Red Hat Enterprise Linux Server channels. Virtualization Manager hosts should be subscribed to these channels and obtain the updates via `yum update`.

Affected upstream versions: n/a
Fixed upstream versions: v_2.0.0
Upstream repository: https://github.com/qos-ch/slf4j
Upstream fix commit: d2b27fba88e983f921558da27fc29b5f5d269405
CVE-2018-8786: freerdp: Integer truncation leading to heap-based buffer overflow in update_read_bitmap_update() function
Component: freerdp
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-10-22T00:00:00+00:00

A flaw was found in freerdp in versions prior to version 2.0.0-rc4. An integer truncation that leads to a heap-based buffer overflow in the update_read_bitmap_update() function results in a memory corruption. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: All versions prior to 2.0.0-rc4
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 445a5a42c500ceb80f8fa7f2c11f3682538033f3
CVE-2018-8787: freerdp: Integer overflow leading to heap-based buffer overflow in gdi_Bitmap_Decompress() function
Component: freerdp
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-10-22T00:00:00+00:00

A flaw was found in freerdp in versions before versions 2.0.0-rc4. An integer overflow that leads to a heap-based buffer overflow in the gdi_Bitmap_Decompress() function leads to memory corruption. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: All versions prior to 2.0.0-rc4
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 09b9d4f1994a674c4ec85b4947aa656eda1aed8a
CVE-2018-8788: freerdp: Out-of-bounds write in nsc_rle_decode() function
Component: freerdp
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-10-22T00:00:00+00:00

A flaw was found in freerdp in versions before 2.0.0-rc4. An out-of-bounds write of up to 4 bytes in the nsc_rle_decode() function results in a memory corruption. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: All versions prior to 2.0.0-rc4
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: d1112c279bd1a327e8e4d0b5f371458bf2579659
CVE-2018-8897: Kernel: error in exception handling leads to DoS
Component: Kernel
Severity: Moderate
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 6.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2018-05-08T00:00:00+00:00

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
CVE-2018-8905: libtiff: heap-based buffer overflow in tif_lzw.c:LZWDecodeCompat() allows for denial of service
Component: libtiff
Severity: Low
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-03-17T00:00:00+00:00

In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tif_lzw.c via a crafted TIFF file, as demonstrated by tiff2ps.


Affected upstream versions: n/a
Fixed upstream versions: v4.0.10
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 58a898cb4459055bb488ca815c23b880c242a27d
CVE-2018-9159: spark: Absolute and relative pathnames allow for unintended static file disclosure
Component: spark
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2018-03-06T00:00:00+00:00

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.


Affected upstream versions: n/a
Upstream repository: https://github.com/perwendel/spark
Upstream fix commit: a221a864db28eb736d36041df2fa6eb8839fc5cd
CVE-2019-1000019: libarchive: Out of bounds read in archive_read_support_format_7zip.c resulting in a denial of service
Component: libarchive
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-01-20T00:00:00+00:00

libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.

Statement: This vulnerability is present in the libarchive package included in Red Hat Virtualization Hypervisor, however it is never exposed to archives created by attackers or users, so the vulnerability can not be exploited.

Affected upstream versions: n/a
Fixed upstream versions: v3.4.0
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: 65a23f5dbee4497064e9bb467f81138a62b0dae1