huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-14465: tcpdump: Buffer over-read in rsvp_obj_print() function in print-rsvp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing RSVP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: bea2686c296b79609060a104cc139810785b0739
CVE-2018-14466: tcpdump: Buffer over-read in print-icmp6.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

The Rx parser in tcpdump before 4.9.3 has a buffer over-read in print-rx.c:rx_cache_find() and rx_cache_insert().


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: c24922e692a52121e853a84ead6b9337f4c08a94
CVE-2018-14467: tcpdump: Buffer over-read in bgp_capabilities_print() in print-bgp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_MP).


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: e3f3b445e2d20ac5d5b7fcb7559ce6beb55da0c9
CVE-2018-14468: tcpdump: Buffer over-read in mfr_print() function in print-fr.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing FRF.16 packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: aa3e54f594385ce7e1e319b0c84999e51192578b
CVE-2018-14469: tcpdump: Buffer over-read in ikev1_n_print() function in print-isakmp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing ISAKMP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 396e94ff55a80d554b1fe46bf107db1e91008d6c
CVE-2018-14470: tcpdump: Buffer over-read in babel_print_v2() in print-babel.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

The Babel parser in tcpdump before 4.9.3 has a buffer over-read in print-babel.c:babel_print_v2().


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 12f66f69f7bf1ec1266ddbee90a7616cbf33696b
CVE-2018-14498: libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service
Component: libjpeg-turbo
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
Public date: 2018-07-20T00:00:00+00:00

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.


Affected upstream versions: n/a
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/libjpeg-turbo/libjpeg-turbo
Upstream fix commit: 9c78a04df4e44ef6487eee99c4258397f4fdca55
CVE-2018-14553: gd: NULL pointer dereference in gdImageClone
Component: gd
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.4 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H)
Public date: 2019-12-20T00:00:00+00:00

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).


Affected upstream versions: n/a
Fixed upstream versions: gd-2.3.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: a93eac0e843148dc2d631c3ba80af17e9c8c860f
CVE-2018-14567: libxml2: Infinite loop caused by incorrect error detection during LZMA decompression
Component: libxml2
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-04-03T00:00:00+00:00

libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.

Statement: Red Hat Product Security has rated this flaw as having Low impact. A future update may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.9.9
Upstream repository: https://gitlab.gnome.org/GNOME/libxml2
Upstream fix commit: 2240fbf5912054af025fb6e01e26375100275e74
CVE-2018-14598: libX11: Crash on invalid reply in XListExtensions in ListExt.c
Component: libX11
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-08-21T00:00:00+00:00

It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service.

Statement: This issue did not affect the versions of libX11 as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable code.

To exploit the vulnerability an attacker would need to have already compromised the X server used by your applications. Normally, the X client that runs libX11 and the X server runs on the same machine, thus if an attacker can trigger this flaw he has already compromised the X server, which runs as root, and he has already full control on the system. If the X client runs on another system than the X server (e.g. DISPLAY environment variable is used and it points to an X server on another system) then exploiting this vulnerability would only crash the client, which should not be run with high privileges.  For the above reasons, this flaw was rated as Moderate Impact.

Affected upstream versions: n/a
Fixed upstream versions: libX11-1.6.6
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libX11
Upstream fix commit: e83722768fd5c467ef61fa159e8c6278770b45c2
CVE-2018-14599: libX11: Off-by-one error in XListExtensions in ListExt.c
Component: libX11
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-08-21T00:00:00+00:00

An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts(). An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption.

Statement: This issue did not affect the versions of libX11 as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable code.

To exploit the vulnerability an attacker would need to have already compromised the X server used by your applications. Normally, the X client that runs libX11 and the X server runs on the same machine, thus if an attacker can trigger this flaw he has already compromised the X server, which runs as root, and he has already full control on the system. If the X client runs on another system than the X server (e.g. DISPLAY environment variable is used and it points to an X server on another system) then exploiting this vulnerability would only gain the privileges of the client, which should not be run with high privileges. For the above reasons, this flaw was rated as Moderate Impact.

Affected upstream versions: n/a
Fixed upstream versions: libX11-1.6.6
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libX11
Upstream fix commit: b469da1430cdcee06e31c6251b83aede072a1ff0
CVE-2018-14600: libX11: Out of Bounds write in XListExtensions in ListExt.c
Component: libX11
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-08-21T00:00:00+00:00

An out of bounds write, limited to NULL bytes, was discovered in libX11 in functions XListExtensions() and XGetFontPath(). The length field is considered as a signed value, which makes the library access memory before the intended buffer. An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption.

Statement: To exploit the vulnerability an attacker would need to have already compromised the X server used by your applications. Normally, the X client that runs libX11 and the X server runs on the same machine, thus if an attacker can trigger this flaw he has already compromised the X server, which runs as root, and he has already full control on the system. If the X client runs on another system than the X server (e.g. DISPLAY environment variable is used and it points to an X server on another system) then exploiting this vulnerability would only gain the privileges of the client, which should not be run with high privileges.  For the above reasons, this flaw was rated as Moderate Impact.

Affected upstream versions: n/a
Fixed upstream versions: libX11-1.6.6
Upstream repository: https://cgit.freedesktop.org/xorg/lib/libX11
Upstream fix commit: dbf72805fd9d7b1846fe9a11b46f3994bfc27fea
CVE-2018-14619: kernel: crash (possible privesc) in kernel crypto api.
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-08-28T00:00:00+00:00

A flaw was found in the crypto subsystem that allowed an attacker 
to crash the system or possibly escalate privileges with a specially crafted program.


Affected upstream versions: kernel-4.15-rc4
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b32a7dc8aef1882fbf983eb354837488cc9d54dc
CVE-2018-14622: libtirpc: Segmentation fault in makefd_xprt return value in svc_vc.c
Component: libtirpc
Severity: Low
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-03-03T00:00:00+00:00

A null-pointer dereference vulnerability was found in libtirpc.  The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors.  A remote attacker could cause an rpc-based application to crash by flooding it with new connections.


Affected upstream versions: 0.3.3-rc3
Upstream repository: https://git.linux-nfs.org/steved/libtirpc.git
Upstream fix commit: 1c77f7a869bdea2a34799d774460d1f9983d45f0
CVE-2018-14632: atomic-openshift: oc patch with json causes masterapi service crash
Component: atomic-openshift
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2018-09-06T00:00:00+00:00

An out of bounds write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform 3.x. An attacker can use this flaw to cause a denial of service attack on the Openshift master API service which provides cluster management.

Statement: A multi-master Openshift Container Platform cluster is more resilient, however a sustained attack would still have an important impact.

Affected upstream versions: atomic-openshift-3.7
Fixed upstream versions: v0.5.2
Upstream repository: https://github.com/evanphx/json-patch
Upstream fix commit: 4c9aadca8f89e349c999f04e28199e96e81aba03
CVE-2018-14633: kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2018-09-24T00:00:00+00:00

A flaw was found in the ISCSI target code in the Linux kernel. The flaw allows an unauthenticated, remote attacker to cause a stack buffer overflow of 17 bytes of the stack. Depending on how the kernel was compiled (e.g. compiler, compile flags, and hardware architecture), the attack may lead to a system crash or access to data exported by an iSCSI target. Privilege escalation cannot be ruled out. The highest threat from this vulnerability is to system availability.


Affected upstream versions: 4.18.x, 4.14.x, 3.10.x
Fixed upstream versions: v4.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
Upstream fix commit: 8c39e2699f8acb2e29782a834e56306da24937fe
CVE-2018-14635: openstack-neutron: A router interface out of subnet IP range results in a denial of service
Component: openstack-neutron
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-03-21T00:00:00+00:00

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool.


Affected upstream versions: 13.0.0.0b2, 12.0.3, 11.0.5
Upstream repository: https://git.openstack.org/cgit/openstack/neutron
Upstream fix commit: 54aa6e81cb17b33ce4d5d469cc11dec2869c762d
CVE-2018-14641: kernel: a bug in ip_frag_reasm() can cause a crash in ip_do_fragment()
Component: kernel
Severity: Important
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-09-18T09:00:00+00:00

A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial of service.


Affected upstream versions: from 4.19-rc1 to 4.19-rc3 inclusive
Fixed upstream versions: v4.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5d407b071dc369c26a38398326ee2be53651cfe4
CVE-2018-14646: kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-11-26T00:00:00+00:00

The Linux kernel was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.

Statement: If you're not running container images, or creating net namepaces exposed to potentially malicious workloads this issue has a security impact of moderate. This issue has an important impact if the system is being used to run container images with untrusted content, such as an OpenShift Container Platform compute node.

Affected upstream versions: 4.15-rc8
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f428fe4a04cc339166c8bbd489789760de3a0cee
CVE-2018-14649: ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution
Component: ceph-iscsi-cli
Severity: Critical
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-09-24T00:00:00+00:00

It was found that rbd-target-api service provided by ceph-iscsi-cli was running in debug mode. An unauthenticated attacker could use this to remotely execute arbitrary code and escalate privileges.

Statement: This issue affects the versions of ceph-iscsi-cli as shipped with Red Hat Ceph Storage 2 and 3. This flaw does not affect python-werkzeug library. It depends on if application uses python-werkzeug library with debug mode enabled.

Affected upstream versions: n/a
Fixed upstream versions: 2.8
Upstream repository: https://github.com/ceph/ceph-iscsi-cli
Upstream fix commit: c3812075e30c76a800a961e7291087d357403f6b
CVE-2018-14650: sos-collector: incorrect permissions set on newly created files
Component: sos-collector
Severity: Moderate
CWE: CWE-276 (Incorrect Default Permissions)
CVSS v3: 5.9 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N)
Public date: 2018-09-27T00:00:00+00:00

It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user. A local attacker may use this flaw by waiting for a legit user to run sos-collector and steal the collected data in the /var/tmp directory.


Affected upstream versions: n/a
Fixed upstream versions: 1.5
Upstream repository: https://github.com/sosreport/sos-collector
Upstream fix commit: 72058f9253e7ed8c7243e2ff76a16d97b03d65ed
CVE-2018-14665: xorg-x11-server: Incorrect permission check in Xorg X server allows for privilege escalation
Component: xorg-x11-server
Severity: Important
CWE: CWE-271 (Privilege Dropping / Lowering Errors)
CVSS v3: 6.6 (CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-10-25T14:00:00+00:00

An incorrect permission check for -modulepath and -logfile options when starting Xorg X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.

Statement: This issue did not affect the versions of xorg-x11-server as shipped with Red Hat Enterprise Linux 5 and 6, as well as Red Hat Enterprise Linux 7 prior to 7.4, as they did not allow the use of vulnerable command line options when running with elevated privileges.

The default X server configuration in Red Hat Enterprise Linux only allows users logged in on the system's physical console to run Xorg X server. Therefore, users which only have remote access to the the system (for example using SSH) can not exploit this flaw.

Affected upstream versions: n/a
Fixed upstream versions: xorg-server-21.0.99.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e
CVE-2018-14679: libmspack: off-by-one error in the CHM PMGI/PMGL chunk number validity checks
Component: libmspack
Severity: Low
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-05-12T00:00:00+00:00

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validity checks, which could lead to denial of service (uninitialized data dereference and application crash).

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: 1.7
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 72e70a921f0f07fee748aec2274b30784e1d312a
CVE-2018-14680: libmspack: off-by-one error in the CHM chunk number validity checks
Component: libmspack
Severity: Low
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-05-12T00:00:00+00:00

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: 1.7
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 72e70a921f0f07fee748aec2274b30784e1d312a
CVE-2018-14681: libmspack: out-of-bounds write in kwajd_read_headers in mspack/kwajd.c
Component: libmspack
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2017-11-26T00:00:00+00:00

An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a one or two byte overwrite.

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: 1.7
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 0b0ef9344255ff5acfac6b7af09198ac9c9756c8
CVE-2018-14682: libmspack: off-by-one error in the TOLOWER() macro for CHM decompression
Component: libmspack
Severity: Low
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-02-06T00:00:00+00:00

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompression.

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: 1.7
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 4fd9ccaa54e1aebde1e4b95fb0163b699fd7bcc8
CVE-2018-14718: jackson-databind: arbitrary code execution in slf4j-ext class
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-07-27T00:00:00+00:00

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code.

Statement: This vulnerability in jackson-databind involves exploiting CVE-2018-1088 against slf4j, which was fixed in Red Hat products through the errata referenced at https://access.redhat.com/security/cve/cve-2018-8088. Applications that link only slf4j versions including that fix are not vulnerable to this vulnerability.

Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle slf4j-ext jar.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.6.7.2
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 87d29af25e82a249ea15858e2d4ecbf64091db44