huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2015-5156: kernel: buffer overflow with fraglist larger than MAX_SKB_FRAGS + 2 in virtio-net
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2015-08-06T00:00:00+00:00

A buffer overflow flaw was found in the way the Linux kernel's virtio-net subsystem handled certain fraglists when the GRO (Generic Receive Offload) functionality was enabled in a bridged network configuration. An attacker on the local network could potentially use this flaw to crash the system, or, although unlikely, elevate their privileges on the system.

Statement: This issue did not affect the Linux kernel packages as shipped with Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.2
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39
CVE-2015-5157: kernel: x86-64: IRET faults during NMIs processing
Component: kernel
Severity: Moderate
CWE: CWE-435 (Improper Interaction Between Multiple Correctly-Behaving Entities)
Public date: 2015-07-22T00:00:00+00:00

A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could use this flaw to crash the system or, potentially (although highly unlikely), escalate their privileges on the system.

Statement: This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future updates in the respective releases may address this flaw.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.2
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 9b6e6a8334d56354853f9c255d1395c2ba570e0a
CVE-2015-5180: glibc: DNS resolver NULL pointer dereference with crafted record type
Component: glibc
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-08-07T00:00:00+00:00

res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.25
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: fc82b0a2dfe7dbd35671c10510a8da1043d746a5
CVE-2015-5194: ntp: crash with crafted logconfig configuration command
Component: ntp
Severity: Low
CWE: CWE-908 (Use of Uninitialized Resource)
Public date: 2015-08-25T00:00:00+00:00

It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.


Affected upstream versions: n/a
Upstream repository: https://github.com/ntp-project/ntp
Upstream fix commit: 553f2fa65865c31c5e3c48812cfd46176cffdd27
CVE-2015-5195: ntp: ntpd crash when processing config commands with statistics type
Component: ntp
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-08-25T00:00:00+00:00

It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (e.g. timingstats) was referenced by the statistics or filegen configuration command.


Affected upstream versions: n/a
Upstream repository: https://github.com/ntp-project/ntp
Upstream fix commit: 52e977d79a0c4ace997e5c74af429844da2f27be
CVE-2015-5219: ntp: infinite loop in sntp processing crafted packet
Component: ntp
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-08-25T00:00:00+00:00

It was discovered that the sntp utility could become unresponsive due to being caught in an infinite loop when processing a crafted NTP packet.


Affected upstream versions: n/a
Upstream repository: https://github.com/ntp-project/ntp
Upstream fix commit: 5f295cd05c3c136d39f5b3e500a2d781bdbb59c8
CVE-2015-5221: jasper: use-after-free and double-free flaws in mif_process_cmpt()
Component: jasper
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2015-08-20T00:00:00+00:00

Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: df5d2867e8004e51e18b89865bc4aa69229227b3
CVE-2015-5252: samba: Insufficient symlink verification in smbd
Component: samba
Severity: Low
CWE: CWE-41 (Improper Resolution of Path Equivalence)
Public date: 2015-12-16T00:00:00+00:00

An access flaw was found in the way Samba verified symbolic links when creating new files on a Samba share. A remote attacker could exploit this flaw to gain access to files outside of Samba's share path.


Affected upstream versions: n/a
Fixed upstream versions: samba-4.3.3
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: 4278ef25f64d5fdbf432ff1534e275416ec9561e
CVE-2015-5253: apache-cxf: SAML SSO processing is vulnerable to wrapping attack
Component: apache-cxf
Severity: Moderate
Public date: 2015-11-14T00:00:00+00:00

It was found that Apache CXF permitted wrapping attacks in its support for SAML SSO. A malicious user could construct a SAML response that would bypass the login screen and possibly gain access to restricted information or resources.


Affected upstream versions: n/a
Upstream repository: https://git-wip-us.apache.org/repos/cxf.git
Upstream fix commit: 845eccb6484b43ba02875c71e824db23ae4f20c0
CVE-2015-5273: abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
Component: abrt
Severity: Moderate
CWE: CWE-377 (Insecure Temporary File)
Public date: 2015-11-23T00:00:00+00:00

It was found that the ABRT debug information installer (abrt-action-install-debuginfo-to-abrt-cache) did not use temporary directories in a secure way. A local attacker could use the flaw to create symbolic links and files at arbitrary locations as the abrt user.


Affected upstream versions: n/a
Fixed upstream versions: 2.7.1
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: 50ee8130fb4cd4ef1af7682a2c85dd99cb99424e
CVE-2015-5279: qemu: Heap overflow vulnerability in ne2000_receive() function
Component: qemu
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2015-09-15T00:00:00+00:00

A heap buffer overflow flaw was found in the way QEMU's NE2000 NIC emulation implementation handled certain packets received over the network. A privileged user inside a guest could use this flaw to crash the QEMU instance (denial of service) or potentially execute arbitrary code on the host.

Statement: This issue affects the versions of kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6.

This issue affects the Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

This issue does not affect the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 7.

This issue does not affect the Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3.

Affected upstream versions: n/a
Fixed upstream versions: v2.4.0.1
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 7aa2bcad0ca837dd6d4bf4fa38a80314b4a6b755
CVE-2015-5282: foreman: XSS in hidden parameter value switcher
Component: foreman
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Public date: 2015-09-17T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.

Statement: This issue affects the versions of foreman as shipped with Red Hat Satellite 6. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: 1.10.0
Upstream repository: https://github.com/theforeman/foreman
Upstream fix commit: 4f3555b217be8723e8045f9816d147b5f684ec57
CVE-2015-5283: kernel: Creating multiple sockets when SCTP module isn't loaded leads to kernel panic
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-09-22T00:00:00+00:00

A NULL pointer dereference flaw was found in the SCTP implementation. A local user could use this flaw to cause a denial of service on the system by triggering a kernel panic when creating multiple sockets in parallel while the system did not have the SCTP module loaded.

Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5, 6 and 7. Due to the limited security impact the issue is currently not planned to be addressed in Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: v4.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4
CVE-2015-5287: abrt: incorrect permissions on /var/spool/abrt
Component: abrt
Severity: Moderate
Public date: 2015-11-23T00:00:00+00:00

It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps of ABRT programs to the ABRT dump directory (/var/spool/abrt).  A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges.


Affected upstream versions: n/a
Fixed upstream versions: 2.7.1
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: 3c1b60cfa62d39e5fff5a53a5bc53dae189e740e
CVE-2015-5289: postgresql: stack overflow DoS when parsing json or jsonb inputs
Component: postgresql
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2015-10-08T00:00:00+00:00

A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input.


Affected upstream versions: n/a
Fixed upstream versions: REL9_6_0
Upstream repository: https://git.postgresql.org/gitweb/postgresql.git
Upstream fix commit: 08fa47c4850cea32c3116665975bca219fbf2fe6
CVE-2015-5296: samba: client requesting encryption vulnerable to downgrade attack
Component: samba
Severity: Moderate
CWE: CWE-345 (Insufficient Verification of Data Authenticity)
Public date: 2015-12-16T00:00:00+00:00

A man-in-the-middle vulnerability was found in the way "connection signing" was implemented by Samba. A remote attacker could use this flaw to downgrade an existing Samba client connection and force the use of plain text.


Affected upstream versions: n/a
Fixed upstream versions: samba-4.3.3
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: a819d2b440aafa3138d95ff6e8b824da885a70e9
CVE-2015-5299: Samba: Missing access control check in shadow copy code
Component: Samba
Severity: Moderate
CWE: CWE-862 (Missing Authorization)
Public date: 2015-12-16T00:00:00+00:00

A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORY_LIST access rights.


Affected upstream versions: n/a
Fixed upstream versions: samba-4.3.3
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: 675fd8d771f9d43e354dba53ddd9b5483ae0a1d7
CVE-2015-5302: libreport: Possible private data leak in Bugzilla bugs opened by ABRT
Component: libreport
Severity: Moderate
CWE: CWE-201 (Insertion of Sensitive Information Into Sent Data)
Public date: 2015-10-15T00:00:00+00:00

It was found that ABRT may have exposed non-public information to Red Hat Bugzilla during crash reporting. A bug in the libreport library caused changes made by a user in files included in a crash report to be discarded. As a result, Red Hat Bugzilla attachments may contain data that was not intended to be made public, including host names, IP addresses, or command line options.


Affected upstream versions: n/a
Fixed upstream versions: 2.6.3
Upstream repository: https://github.com/abrt/libreport
Upstream fix commit: 257578a23d1537a2d235aaa2b1488ee4f818e360
CVE-2015-5307: virt: guest to host DoS by triggering an infinite loop in microcode via #AC exception
Component: virt
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-11-10T00:00:00+00:00

It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel.

Statement: This issue affects the version of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5.

This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and 7. Future kernel updates for the respective releases may address this issue.

Red Hat Enterprise Linux 5 is now in Production Phase 3 of the support and maintenance life cycle. Thus it is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.4
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 54a20552e1eae07aa240fa370a0293e006b5faed
CVE-2015-5312: libxml2: CPU exhaustion when processing specially crafted XML input
Component: libxml2
Severity: Moderate
Public date: 2015-12-01T00:00:00+00:00

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to use an excessive amount of CPU.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.3
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 69030714cde66d525a8884bda01b9e8f0abf8e1e
CVE-2015-5313: libvirt: filesystem storage volume names path traversal flaw
Component: libvirt
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
Public date: 2015-12-11T00:00:00+00:00

A path-traversal flaw was found in the way the libvirt daemon handled filesystem names for storage volumes. A libvirt user with privileges to create storage volumes and without privileges to create and modify domains could possibly use this flaw to escalate their privileges.

Statement: This issue affects the versions of libvirt as shipped with Red Hat Enterprise Linux version 7 and Red Hat Gluster Storage 3.1. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v1.3.1
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: 034e47c338b13a95cf02106a3af912c1c5f818d7
CVE-2015-5330: libldb: remote memory read in the Samba LDAP server
Component: libldb
Severity: Moderate
CWE: CWE-135 (Incorrect Calculation of Multi-Byte String Length)
Public date: 2015-12-16T00:00:00+00:00

A memory-read flaw was found in the way the libldb library processed LDB DN records with a null byte. An authenticated, remote attacker could use this flaw to read heap-memory pages from the server.


Affected upstream versions: n/a
Fixed upstream versions: tevent-0.9.27
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: f36cb71c330a52106e36028b3029d952257baf15
CVE-2015-5352: openssh: XSECURITY restrictions bypass under certain conditions in ssh(1)
Component: openssh
Severity: Moderate
Public date: 2015-07-01T00:00:00+00:00

It was found that the OpenSSH client did not properly enforce the ForwardX11Timeout setting. A malicious or compromised remote X application could possibly use this flaw to establish a trusted connection to the local X server, even if only untrusted X11 forwarding was requested.

Statement: This issue does not affect the version of openssh package as shipped with Red Hat Enterprise Linux 7. This issue affects the version of openssh package as shipped with Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates.

Affected upstream versions: n/a
Fixed upstream versions: V_6_9_P1
Upstream repository: https://anongit.mindrot.org/openssh.git
Upstream fix commit: 1bf477d3cdf1a864646d59820878783d42357a1d
CVE-2015-5364: kernel: net: incorrect processing of checksums in UDP implementation
Component: kernel
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-07-01T00:00:00+00:00

A flaw was found in the way the Linux kernel's networking implementation handled UDP packets with incorrect checksum values. A remote attacker could potentially use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service on the system, or cause a denial of service in applications using the edge triggered epoll functionality.


Affected upstream versions: n/a
Fixed upstream versions: v4.1
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: beb39db59d14990e401e235faf66a6b9b31240b0
CVE-2015-5366: kernel: net: incorrect processing of checksums in UDP implementation
Component: kernel
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-07-01T00:00:00+00:00

A flaw was found in the way the Linux kernel's networking implementation handled UDP packets with incorrect checksum values. A remote attacker could potentially use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service on the system, or cause a denial of service in applications using the edge triggered epoll functionality.


Affected upstream versions: n/a
Fixed upstream versions: v4.1
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: beb39db59d14990e401e235faf66a6b9b31240b0
CVE-2015-5589: php: segmentation fault in Phar::convertToData on invalid file
Component: php
Severity: Moderate
Public date: 2015-07-05T00:00:00+00:00

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.43
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: bf58162ddf970f63502837f366930e44d6a992cf
CVE-2015-5590: php: buffer overflow and stack smashing error in phar_fix_filepath
Component: php
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2015-07-05T00:00:00+00:00

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.43
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 6dedeb40db13971af45276f80b5375030aa7e76f
CVE-2015-5739: golang: HTTP request smuggling in net/http library
Component: golang
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
Public date: 2015-07-29T00:00:00+00:00

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error (the second field is ignored), and invalid fields are parsed as valid (for example, "Content Length:" with a space in the middle is accepted).  A non-authenticated attacker could exploit these flaws to bypass security controls, perform web-cache poisoning, or alter the request/response map (denial of service).


Affected upstream versions: n/a
Fixed upstream versions: go1.5
Upstream repository: https://github.com/golang/go
Upstream fix commit: 117ddcb83d7f42d6aa72241240af99ded81118e9
CVE-2015-5740: golang: HTTP request smuggling in net/http library
Component: golang
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
Public date: 2015-07-29T00:00:00+00:00

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error (the second field is ignored), and invalid fields are parsed as valid (for example, "Content Length:" with a space in the middle is accepted).  A non-authenticated attacker could exploit these flaws to bypass security controls, perform web-cache poisoning, or alter the request/response map (denial of service).


Affected upstream versions: n/a
Fixed upstream versions: go1.5
Upstream repository: https://github.com/golang/go
Upstream fix commit: 300d9a21583e7cf0149a778a0611e76ff7c6680f
CVE-2015-5741: golang: HTTP request smuggling in net/http library
Component: golang
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
Public date: 2015-07-29T00:00:00+00:00

HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error (the second field is ignored), and invalid fields are parsed as valid (for example, "Content Length:" with a space in the middle is accepted).  A non-authenticated attacker could exploit these flaws to bypass security controls, perform web-cache poisoning, or alter the request/response map (denial of service).


Affected upstream versions: n/a
Fixed upstream versions: go1.5
Upstream repository: https://github.com/golang/go
Upstream fix commit: 300d9a21583e7cf0149a778a0611e76ff7c6680f