huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2014-0022: yum: yum-cron installs unsigned packages
Component: yum
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
Public date: 2014-01-13T00:00:00+00:00

It was discovered that yum-updatesd did not properly perform RPM package signature checks. When yum-updatesd was configured to automatically install updates, a remote attacker could use this flaw to install a malicious update on the target system using an unsigned RPM or an RPM signed with an untrusted key.

Statement: This issue did not affect the versions of yum as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Upstream repository: https://yum.baseurl.org/yum.git
Upstream fix commit: 9df69e5794
CVE-2014-0040: openstack-heat-templates: use of HTTP to download signing keys/code
Component: openstack-heat-templates
Severity: Low
CWE: CWE-494 (Download of Code Without Integrity Check)
Public date: 2014-01-09T00:00:00+00:00

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.


Affected upstream versions: n/a
Upstream repository: https://github.com/openstack/heat-templates
Upstream fix commit: 65a4f8bebc72da71c616e2e378b7b1ac354db1a3
CVE-2014-0042: openstack-heat-templates: setting gpgcheck=0 for signed packages
Component: openstack-heat-templates
Severity: Low
CWE: CWE-494 (Download of Code Without Integrity Check)
Public date: 2014-01-09T00:00:00+00:00

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.


Affected upstream versions: n/a
Upstream repository: https://github.com/openstack/heat-templates
Upstream fix commit: 65a4f8bebc72da71c616e2e378b7b1ac354db1a3
CVE-2014-0063: postgresql: stack-based buffer overflow in datetime input/output
Component: postgresql
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2014-02-17T00:00:00+00:00

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.


Affected upstream versions: n/a
Fixed upstream versions: REL9_4_0
Upstream repository: https://github.com/postgres/postgres
Upstream fix commit: 4318daecc959886d001a6e79c6ea853e8b1dfb4b
CVE-2014-0064: postgresql: integer overflows leading to buffer overflows
Component: postgresql
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-02-17T00:00:00+00:00

Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow.  NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.


Affected upstream versions: n/a
Fixed upstream versions: REL9_4_0
Upstream repository: https://github.com/postgres/postgres
Upstream fix commit: 31400a673325147e1205326008e32135a78b4d8a
CVE-2014-0069: kernel: cifs: incorrect handling of bogus user pointers during uncached writes
Component: kernel
Severity: Moderate
Public date: 2014-02-14T00:00:00+00:00

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v3.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5d81de8e8667da7135d3a32a964087c0faf5483f
CVE-2014-0077: kernel: vhost-net: insufficiency in handling of big packets in handle_rx()
Component: kernel
Severity: Moderate
Public date: 2014-03-27T00:00:00+00:00

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

Statement: This issue does not affect Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d8316f3991d207fe32881a9ac20241be8fa2bad0
CVE-2014-0086: RichFaces: remote denial of service via memory exhaustion
Component: RichFaces
Severity: Moderate
Public date: 2014-02-14T00:00:00+00:00

It was found that certain malformed requests caused RichFaces to leak memory. A remote, unauthenticated attacker could use this flaw to send a large number of malformed requests to a RichFaces application that uses the Atmosphere framework, leading to a denial of service (excessive memory consumption) on the application server.


Affected upstream versions: n/a
Upstream repository: https://github.com/pslegr/core-1
Upstream fix commit: 8131f15003f5bec73d475d2b724472e4b87d0757
CVE-2014-0101: kernel: net: sctp: null pointer dereference when processing authenticated cookie_echo chunk
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-03-03T00:00:00+00:00

A flaw was found in the way the Linux kernel processed an authenticated COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote attacker could use this flaw to crash the system by initiating a specially crafted SCTP handshake in order to trigger a NULL pointer dereference on the system.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.14
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ec0223ec48a90cb605244b45f7c62de856403729
CVE-2014-0142: qemu: crash by possible division by zero
Component: qemu
Severity: Low
CWE: CWE-369 (Divide By Zero)
Public date: 2014-03-26T00:00:00+00:00

QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 8e53abbc20d08ae3ec30c2054e1161314ad9501d
CVE-2014-0143: Qemu: block: multiple integer overflow flaws
Component: Qemu
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-03-26T00:00:00+00:00

Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f
CVE-2014-0144: Qemu: block: missing input validation
Component: Qemu
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
Public date: 2014-03-26T00:00:00+00:00

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 24342f2cae47d03911e346fe1e520b00dc2818e0
CVE-2014-0145: Qemu: prevent possible buffer overflows
Component: Qemu
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2014-03-26T00:00:00+00:00

Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).


Affected upstream versions: n/a
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: f0dce23475b5af5da6b17b97c1765271307734b6
CVE-2014-0146: Qemu: qcow2: NULL dereference in qcow2_open() error path
Component: Qemu
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-03-26T00:00:00+00:00

The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.


Affected upstream versions: n/a
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 11b128f4062dd7f89b14abc8877ff20d41b28be9
CVE-2014-0147: Qemu: block: possible crash due signed types or logic error
Component: Qemu
Severity: Moderate
Public date: 2014-03-26T00:00:00+00:00

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.


Affected upstream versions: before 1.6.2
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 246f65838d19db6db55bfb41117c35645a2c4789
CVE-2014-0148: Qemu: vhdx: bounds checking for block_size and logical_sector_size
Component: Qemu
Severity: Low
Public date: 2014-03-26T00:00:00+00:00

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.

Statement: This issue does not affect the versions of kvm package as shipped with Red Hat
Enterprise Linux 5.

This issue affects the versions of qemu-kvm package as shipped with Red Hat
Enterprise Linux 6.

Affected upstream versions: before 2.0
Fixed upstream versions: v2.0.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 1d7678dec4761acdc43439da6ceda41a703ba1a6
CVE-2014-0160: openssl: information disclosure in handling of TLS heartbeat extension packets
Component: openssl
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
Public date: 2014-04-07T00:00:00+00:00

An information disclosure flaw was found in the way OpenSSL handled TLS and DTLS Heartbeat Extension packets. A malicious TLS or DTLS client or server could send a specially crafted TLS or DTLS Heartbeat packet to disclose a limited portion of memory per request from a connected client or server. Note that the disclosed portions of memory could potentially include sensitive information such as private keys.

Statement: This issue did not affect the versions of openssl as shipped with Red Hat Enterprise Linux 5, Red Hat Enterprise Linux 6.4 and earlier, Red Hat JBoss Enterprise Application Platform 5 and 6, and Red Hat JBoss Web Server 1 and 2. This issue does affect Red Hat Enterprise Linux 7 Beta, Red Hat Enterprise Linux 6.5, Red Hat Enterprise Virtualization Hypervisor 6.5, and Red Hat Storage 2.1, which provided openssl 1.0.1e. Errata have been released to correct this issue.

Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/announcements/781953

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1g
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 96db9023b881d7cd9f379b0c154650d6c108e9a3
CVE-2014-0181: kernel: net: insufficient permision checks of netlink messages
Component: kernel
Severity: Moderate
Public date: 2014-04-23T00:00:00+00:00

It was found that the permission checks performed by the Linux kernel when a netlink message was received were not sufficient. A local, unprivileged user could potentially bypass these restrictions by passing a netlink socket as stdout or stderr to a more privileged process and altering the output of this process.


Affected upstream versions: n/a
Fixed upstream versions: v3.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git
Upstream fix commit: 90f62cf30a78721641e08737bda787552428061e
CVE-2014-0182: qemu: virtio: out-of-bounds buffer write on state load with invalid config_len
Component: qemu
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2014-04-17T00:00:00+00:00

Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.


Affected upstream versions: n/a
Fixed upstream versions: v2.1.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: a890a2f9137ac3cf5b607649e66a6f3a5512d8dc
CVE-2014-0191: libxml2: external parameter entity loaded when entity substitution is disabled
Component: libxml2
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
Public date: 2014-05-06T00:00:00+00:00

It was discovered that libxml2 loaded external parameter entities even when entity substitution was disabled. A remote attacker able to provide a specially crafted XML file to an application linked against libxml2 could use this flaw to conduct XML External Entity (XXE) attacks, possibly resulting in a denial of service or an information leak on the system.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.2
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 9cd1c3cfbd32655d60572c0a413e017260c854df
CVE-2014-0195: openssl: Buffer overflow via DTLS invalid fragment
Component: openssl
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2014-06-05T00:00:00+00:00

The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.

Statement: This issue does not affect the version of openssl as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of openssl098e as shipped with Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1h
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 1632ef744872edc2aa2a53d487d3e79c965a4ad3
CVE-2014-0196: kernel: pty layer race condition leading to memory corruption
Component: kernel
Severity: Important
Public date: 2014-05-01T00:00:00+00:00

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

Statement: This issue did not affect the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

This issue affected the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 prior to version kernel-2.6.32-358.6.1.el6, released via RHSA-2013:0744 (https://rhn.redhat.com/errata/RHSA-2013-0744.html). That update added a backport of the upstream commit c56a00a165, which avoided this issue.

This flaw requires local system access to be exploited. We are currently not aware of any working exploit for Red Hat Enterprise Linux 6 or Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 4291086b1f081b869c6d79e5b7441633dc3ace00
CVE-2014-0203: kernel: fs: slab corruption due to the invalid last component type during do_filp_open()
Component: kernel
Severity: Moderate
Public date: 2014-06-19T00:00:00+00:00

The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 86acdca1b63e6890540fa19495cfc708beff3d8b
CVE-2014-0205: kernel: futex: refcount issue in case of requeue
Component: kernel
Severity: Important
CWE: CWE-911 (Improper Update of Reference Count)
Public date: 2014-09-09T00:00:00+00:00

A flaw was found in the way the Linux kernel's futex subsystem handled reference counting when requeuing futexes during futex_wait(). A local, unprivileged user could use this flaw to zero out the reference counter of an inode or an mm struct that backs up the memory area of the futex, which could lead to a use-after-free flaw, resulting in a system crash or, potentially, privilege escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG-2.

Future Linux kernel updates for Red Hat Enterprise Linux 6 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 7ada876a8703f23befbb20a7465a702ee39b1704
CVE-2014-0206: kernel: aio: insufficient sanitization of head in aio_read_events_ring()
Component: kernel
Severity: Moderate
Public date: 2014-06-24T00:00:00+00:00

Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: edfbbf388f29
CVE-2014-0207: file: cdf_read_short_sector insufficient boundary check
Component: file
Severity: Moderate
Public date: 2014-06-27T00:00:00+00:00

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Statement: This issue does not affect the file, php, or php53 packages in Red Hat Enterprise Linux 5 and 6. This issue affects the file package in Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update my address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: FILE5_19
Upstream repository: https://github.com/file/file
Upstream fix commit: 6d209c1c489457397a5763bca4b28e43aac90391
CVE-2014-0221: openssl: DoS when sending invalid DTLS handshake
Component: openssl
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
Public date: 2014-06-05T00:00:00+00:00

A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1h
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: d3152655d5319ce883c8e3ac4b99f8de4c59d846
CVE-2014-0224: openssl: SSL/TLS MITM vulnerability
Component: openssl
Severity: Important
CWE: CWE-841 (Improper Enforcement of Behavioral Workflow)
Public date: 2014-06-05T00:00:00+00:00

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1h
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: bc8923b1ec9c467755cd86f7848c50ee8812e441
CVE-2014-0237: file: cdf_unpack_summary_info() excessive looping DoS
Component: file
Severity: Moderate
CWE: CWE-407 (Inefficient Algorithmic Complexity)
Public date: 2014-05-29T00:00:00+00:00

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Statement: This issue did not affect the php and the file packages as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of file as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: FILE5_19
Upstream repository: https://github.com/file/file
Upstream fix commit: b8acc83781d5a24cc5101e525d15efe0482c280d