huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2015-8845: kernel: incorrect restoration of machine specific registers from userspace
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
Public date: 2016-04-13T00:00:00+00:00

A flaw was found in the Linux kernel which could cause a kernel panic when restoring machine specific registers on the PowerPC platform. Incorrect transactional memory state registers could inadvertently change the call path on return from userspace and cause the kernel to enter an unknown state and crash.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6,

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7 and MRG-2 realtime kernels.

For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/ .

Affected upstream versions: n/a
Fixed upstream versions: v4.4
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7f821fc9c77a9b01fe7b1d6e72717b33d8d64142
CVE-2015-8851: nodejs-node-uuid: insecure entropy source - Math.random()
Component: nodejs-node-uuid
Severity: Moderate
CWE: CWE-331 (Insufficient Entropy)
Public date: 2016-03-30T00:00:00+00:00

It was found that NodeJS node-uuid used Math.random() to create a GUID (Globally Unique Identifier) which does not provide enough entropy (on some platforms it only provides 32 bits) which can result in collisions of GUIDs. An attacker could use this to guess GUID values and leverage further attacks against a system using node-uuid.


Affected upstream versions: before 1.4.4
Fixed upstream versions: v1.4.4
Upstream repository: https://github.com/broofa/node-uuid
Upstream fix commit: 672f3834ed02c798aa021c618d0a5666c8da000d
CVE-2015-8863: jq: heap-buffer-overflow in tokenadd() function
Component: jq
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2015-10-18T00:00:00+00:00

A heap-based buffer overflow flaw was found in jq's tokenadd() function. By tricking a victim into processing a specially crafted JSON file, an attacker could use this flaw to crash jq or, potentially, execute arbitrary code on the victim's system.


Affected upstream versions: n/a
Fixed upstream versions: jq-1.6
Upstream repository: https://github.com/stedolan/jq
Upstream fix commit: 8eb1367ca44e772963e704a700ef72ae2e12babd
CVE-2015-8865: file: Buffer over-write in finfo_open with malformed magic file
Component: file
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-02-23T00:00:00+00:00

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.


Affected upstream versions: n/a
Fixed upstream versions: FILE5_23
Upstream repository: https://github.com/file/file
Upstream fix commit: 6713ca45e7757297381f4b4cdb9cf5e624a9ad36
CVE-2015-8866: php: libxml_disable_entity_loader setting is shared between threads
Component: php
Severity: Low
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2016-04-21T00:00:00+00:00

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.22
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: de31324c221c1791b26350ba106cc26bad23ace9
CVE-2015-8867: php: openssl_random_pseudo_bytes() is not cryptographically secure
Component: php
Severity: Moderate
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-04-21T00:00:00+00:00

The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.44
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 16023f3e3b9c06cf677c3c980e8d574e4c162827
CVE-2015-8868: poppler: heap buffer overflow in ExponentialFunction
Component: poppler
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2016-04-11T00:00:00+00:00

A heap-buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.40.0
Upstream repository: https://cgit.freedesktop.org/poppler/poppler
Upstream fix commit: b3425dd3261679958cd56c0f71995c15d2124433
CVE-2015-8869: ocaml: sizes arguments are sign-extended from 32 to 64 bits
Component: ocaml
Severity: Moderate
CWE: CWE-194 (Unexpected Sign Extension)
Public date: 2016-04-28T00:00:00+00:00

An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak.


Affected upstream versions: n/a
Fixed upstream versions: 4.03.0
Upstream repository: https://github.com/ocaml/ocaml
Upstream fix commit: 659615c7b100a89eafe6253e7a5b9d84d0e8df74
CVE-2015-8873: php: Stack consumption vulnerability in Zend/zend_exceptions.c
Component: php
Severity: Low
CWE: CWE-674 (Uncontrolled Recursion)
Public date: 2015-08-04T00:00:00+00:00

Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.44
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 4d2278143a08b7522de9471d0f014d7357c28fea
CVE-2015-8877: gd: gdImageScaleTwoPass function in gd_interpolation.c uses inconsistent allocate and free approaches
Component: gd
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
Public date: 2015-07-13T00:00:00+00:00

The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.


Affected upstream versions: n/a
Fixed upstream versions: gd-2.2.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: 4751b606fa38edc456d627140898a7ec679fcc24
CVE-2015-8895: ImageMagick: Integer and buffer overflow in coders/icon.c
Component: ImageMagick
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2015-05-28T00:00:00+00:00

Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.1-0
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 0f6fc2d5bf8f500820c3dbcf0d23ee14f2d9f734
CVE-2015-8896: ImageMagick: Integer truncation vulnerability in coders/pict.c
Component: ImageMagick
Severity: Moderate
Public date: 2015-04-26T00:00:00+00:00

Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.1-0
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 0f6fc2d5bf8f500820c3dbcf0d23ee14f2d9f734
CVE-2015-8897: ImageMagick: Crash due to out of bounds error in SpliceImage
Component: ImageMagick
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2016-01-17T00:00:00+00:00

The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (application crash) via a crafted png file.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.1-0
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 7b1cf5784b5bcd85aa9293ecf56769f68c037231
CVE-2015-8898: ImageMagick: Prevent NULL pointer access in magick/constitute.c
Component: ImageMagick
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2016-01-17T00:00:00+00:00

The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image file.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.1-0
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 5b4bebaa91849c592a8448bc353ab25a54ff8c44
CVE-2015-8935: php: HTTP response splitting in header() function
Component: php
Severity: Moderate
CWE: CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'))
CVSS v3: 3.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2015-02-03T00:00:00+00:00

The header() PHP function allowed header stings containing line break followed by a space or tab, as allowed by RFC 2616. Certain browsers handled the continuation line as new header, making it possible to conduct a HTTP response splitting attack against such browsers. The header() function was updated to follow RFC 7230 and not allow any line breaks.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.22
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 996faf964bba1aec06b153b370a7f20d3dd2bb8b
CVE-2015-8947: chromium-browser: Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6
Component: chromium-browser
Severity: Moderate
Public date: 2016-01-24T00:00:00+00:00

hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.


Affected upstream versions: n/a
Fixed upstream versions: 1.0.5
Upstream repository: https://github.com/behdad/harfbuzz
Upstream fix commit: f96664974774bfeb237a7274f512f64aaafb201e
CVE-2015-8956: kernel: NULL dereference in RFCOMM bind callback
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2015-05-14T00:00:00+00:00

The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.2
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 951b6a0717db97ce420547222647bcc40bf1eacd
CVE-2015-8970: kernel: crypto: GPF in lrw_crypt caused by null-deref
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2015-12-17T00:00:00+00:00

The lrw_crypt() function in 'crypto/lrw.c' in the Linux kernel before 4.5 allows local users to cause a system crash and a denial of service by the NULL pointer dereference via accept(2) system call for AF_ALG socket without calling setkey() first to set a cipher key.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.5
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: dd504589577d8e8e70f51f997ad487a4cb6c026f
CVE-2015-9096: ruby: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP
Component: ruby
Severity: Low
CWE: CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-06-12T00:00:00+00:00

A SMTP command injection flaw was found in the way Ruby's Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands in a SMTP session in order to facilitate phishing attacks or spam campaigns.


Affected upstream versions: n/a
Fixed upstream versions: v2_4_0
Upstream repository: https://github.com/ruby/ruby
Upstream fix commit: 0827a7e52ba3d957a634b063bf5a391239b9ffee
CVE-2015-9251: jquery: Cross-site scripting via cross-domain ajax requests
Component: jquery
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2015-06-27T00:00:00+00:00

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.


Affected upstream versions: n/a
Upstream repository: https://github.com/jquery/jquery
Upstream fix commit: c254d308a7d3f1eac4d0b42837804cfffcba4bb2
CVE-2015-9262: libxcursor: 1-byte heap-based overflow in _XcursorThemeInherits function in library.c
Component: libxcursor
Severity: Low
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 4.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-08-01T00:00:00+00:00

_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.

Statement: This issue affects the versions of libXcursor as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Affected upstream versions: n/a
Fixed upstream versions: libXcursor-1.1.15
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libXcursor
Upstream fix commit: 897213f36baf6926daf6d192c709cf627aa5fd05
CVE-2015-9289: kernel: out of bound read in DVB connexant driver.
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2019-07-27T00:00:00+00:00

A vulnerability was found in the Linux kernel’s CX24116 tv-card driver, where an out of bounds read occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. An attacker could use this flaw to leak kernel private information to userspace.

Statement: This flaw requires a Conexant CX24116 series TV-media card to be in the system for this driver to load.  This flaw is when an attacker attempts to use the card to communicate with a satellite tv control subsystem ( via Digital Satellite Equipment Control command) by issuing a specially crafted ioctl to the device.

Affected upstream versions: n/a
Fixed upstream versions: v4.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 1fa2337a315a2448c5434f41e00d56b01a22283c
CVE-2015-9381: freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c leading to crash
Component: freetype
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-09-17T00:00:00+00:00

An out-of-bounds buffer overflow flaw was found in FreeType prior to version 2.6.1.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/type1/t1parse.c
Upstream fix commit: 7962a15d64c876870ca0ae435ea2467d9be268d9
CVE-2015-9382: freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment, psaux/psobjs.c, leads to a buffer over-read
Component: freetype
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2019-09-03T00:00:00+00:00

FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/src/psaux/psobjs.c
Upstream fix commit: db5a4a9ae7b0048f033361744421da8569642f73
CVE-2016-0546: mysql: unspecified vulnerability in subcomponent: Client (CPU January 2016)
Component: mysql
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
Public date: 2015-01-20T00:00:00+00:00

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that these are multiple buffer overflows in the mysqlshow tool that allow remote database servers to have unspecified impact via a long table or database name.


Affected upstream versions: n/a
Fixed upstream versions: mysql-5.5.47
Upstream repository: https://github.com/mysql/mysql-server
Upstream fix commit: 0dbd5a8797ed4bd18e8b883988fb62177eb0f73f
CVE-2016-0702: OpenSSL: Side channel attack on modular exponentiation
Component: OpenSSL
Severity: Low
Public date: 2016-03-01T00:00:00+00:00

A side-channel attack was found that makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. An attacker who has the ability to control code in a thread running on the same hyper-threaded core as the victim's thread that is performing decryption, could use this flaw to recover RSA private keys.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2g
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 708dc2f1291e104fe4eef810bb8ffc1fae5b19c1
CVE-2016-0703: openssl: Divide-and-conquer session key recovery in SSLv2
Component: openssl
Severity: Moderate
Public date: 2016-03-01T00:00:00+00:00

It was discovered that the SSLv2 servers using OpenSSL accepted SSLv2 connection handshakes that indicated non-zero clear key length for non-export cipher suites. An attacker could use this flaw to decrypt recorded SSLv2 sessions with the server by using it as a decryption oracle.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2b
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: ae50d8270026edf5b3c7f8aaa0c6677462b33d97
CVE-2016-0704: openssl: SSLv2 Bleichenbacher protection overwrites wrong bytes for export ciphers
Component: openssl
Severity: Moderate
Public date: 2016-03-01T00:00:00+00:00

It was discovered that the SSLv2 protocol implementation in OpenSSL did not properly implement the Bleichenbacher protection for export cipher suites. An attacker could use a SSLv2 server using OpenSSL as a Bleichenbacher oracle.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2b
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: ae50d8270026edf5b3c7f8aaa0c6677462b33d97
CVE-2016-0705: OpenSSL: Double-free in DSA code
Component: OpenSSL
Severity: Low
Public date: 2016-02-18T00:00:00+00:00

A double-free flaw was found in the way OpenSSL parsed certain malformed DSA (Digital Signature Algorithm) private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2g
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 6c88c71b4e4825c7bc0489306d062d017634eb88
CVE-2016-0720: pcs: Cross-Site Request Forgery in web UI
Component: pcs
Severity: Moderate
CWE: CWE-352 (Cross-Site Request Forgery (CSRF))
Public date: 2016-02-16T00:00:00+00:00

A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes.

Statement: This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 6, as the web UI functionality is disabled by default in pcsd.

Affected upstream versions: n/a
Fixed upstream versions: 0.9.149
Upstream repository: https://github.com/ClusterLabs/pcs
Upstream fix commit: b9e7f061788c3b86a0c67d2d4158f067ec5eb625
CVE-2016-0721: pcs: cookies are not invalidated upon logout
Component: pcs
Severity: Moderate
CWE: CWE-613 (Insufficient Session Expiration)
Public date: 2016-02-16T00:00:00+00:00

It was found that pcsd did not invalidate cookies on the server side when a user logged out. This could potentially allow an attacker to perform session fixation attacks on pcsd.

Statement: This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 6, as the web UI functionality is disabled by default in pcsd.

Affected upstream versions: n/a
Fixed upstream versions: 0.9.149
Upstream repository: https://github.com/ClusterLabs/pcs
Upstream fix commit: bc6ad9086857559db57f4e3e6de66762291c0774
CVE-2016-0728: kernel: Possible use-after-free vulnerability in keyring facility
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
Public date: 2016-01-19T00:00:00+00:00

A use-after-free flaw was found in the way the Linux kernel's key management subsystem handled keyring object reference counting in certain error path of the join_session_keyring() function. A local, unprivileged user could use this flaw to escalate their privileges on the system.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6. 

Refer to https://access.redhat.com/node/2131021 for further information.

Affected upstream versions: n/a
Fixed upstream versions: v4.5
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2