huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2010-3437: kernel: pktcdvd ioctl dev_minor missing range check
Component: kernel
Severity: Moderate
Public date: 2010-09-28T00:00:00+00:00

Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 did not include support for Packet writing layer for ATAPI and SCSI disc media devices, and therefore are not affected by this issue. The Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG only allow root access to the "/dev/pktcdvd/control" file, and therefore are also not affected by this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 252a52aa4fa22a668f019e55b3aac3ff71ec1c29
CVE-2010-3442: kernel: prevent heap corruption in snd_ctl_new()
Component: kernel
Severity: Important
Public date: 2010-09-28T00:00:00+00:00

Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/tiwai/sound-2.6.git
Upstream fix commit: 5591bf07225523600450edd9e6ad258bb877b779
CVE-2010-3448: kernel: thinkpad-acpi: lock down video output state access
Component: kernel
Severity: Moderate
Public date: 2010-02-26T00:00:00+00:00

drivers/platform/x86/thinkpad_acpi.c in the Linux kernel before 2.6.34 on ThinkPad devices, when the X.Org X server is used, does not properly restrict access to the video output control state, which allows local users to cause a denial of service (system hang) via a (1) read or (2) write operation.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b525c06cdbd8a3963f0173ccd23f9147d4c384b5
CVE-2010-3477: kernel: net/sched/act_police.c infoleak
Component: kernel
Severity: Moderate
Public date: 2010-09-01T00:00:00+00:00

The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/davem/net-2.6.git
Upstream fix commit: 0f04cfd098fb81fded74e78ea1a1b86cc6c6c31e
CVE-2010-3698: kvm: invalid selector in fs/gs causes kernel panic
Component: kvm
Severity: Moderate
Public date: 2010-10-19T00:00:00+00:00

The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).


Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9581d442b9058d3699b4be568b6e5eae38a41493
CVE-2010-3702: xpdf: uninitialized Gfx::parser pointer dereference
Component: xpdf
Severity: Important
Public date: 2010-09-24T00:00:00+00:00

The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.15.1
Upstream repository: https://cgit.freedesktop.org/poppler/poppler
Upstream fix commit: e853106b58d6b4b0467dbd6436c9bb1cfbd372cf
CVE-2010-3703: poppler: use of initialized pointer in PostScriptFunction
Component: poppler
Severity: Important
Public date: 2010-09-24T00:00:00+00:00

The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.15.1
Upstream repository: https://cgit.freedesktop.org/poppler/poppler
Upstream fix commit: bf2055088a3a2d3bb3d3c37d464954ec1a25771f
CVE-2010-3704: xpdf: array indexing error in FoFiType1::parse()
Component: xpdf
Severity: Important
Public date: 2010-09-24T00:00:00+00:00

The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.15.1
Upstream repository: https://cgit.freedesktop.org/poppler/poppler
Upstream fix commit: 39d140bfc0b8239bdd96d6a55842034ae5c05473
CVE-2010-3705: kernel: sctp memory corruption in HMAC handling
Component: kernel
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2010-10-01T00:00:00+00:00

The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.

Statement: Red Hat is aware of this issue and is tracking it via the following bug:
https://bugzilla.redhat.com/CVE-2010-3705.

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for SCTP. It did not affect Red Hat Enterprise Linux 4 and 5 as it did not include upstream commit 1f485649 that introduced the problem. Future kernel updates in Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/davem/net-2.6.git
Upstream fix commit: 51e97a12bef19b7e43199fc153cf9bd5f2140362
CVE-2010-3855: Freetype : Heap based buffer overflow in ft_var_readpackedpoints()
Component: Freetype
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2010-10-11T00:00:00+00:00

Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git
Upstream fix commit: 59eb9f8cfe7d1df379a2318316d1f04f80fba54a
CVE-2010-3858: kernel: setup_arg_pages: diagnose excessive argument size
Component: kernel
Severity: Moderate
Public date: 2010-08-13T00:00:00+00:00

The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 as they did not backport the upstream commit b6a2fea3 that introduced the issue. This was addressed in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0004.html and 
https://rhn.redhat.com/errata/RHSA-2010-0958.html. Future kernel updates in Red Hat Enterprise Linux 6 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1b528181b2ffa14721fb28ad1bd539fe1732c583
CVE-2010-3859: kernel: tipc: heap overflow in tipc_msg_build()
Component: kernel
Severity: Important
Public date: 2010-10-22T00:00:00+00:00

Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.

Statement: Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/CVE-2010-3859.

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 6 and Red Hat Enterprise MRG as they did not include support for Transparent Inter-Process Communication Protocol (TIPC). A future kernel update in Red Hat Enterprise Linux 5 may address this flaw. As a
preventive measure, we plan to include the fixes in a future kernel update in Red Hat Enterprise Linux 4.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8acfe468b0384e834a303f08ebc4953d72fb690a
CVE-2010-3860: IcedTea System property information leak via public static
Component: IcedTea System property information leak via public static
Severity: Moderate
Public date: 2010-11-24T00:00:00+00:00

IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea6-1.9
Upstream fix commit: 9aa0018d8c28
CVE-2010-3861: kernel: heap contents leak from ETHTOOL_GRXCLSRLALL
Component: kernel
Severity: Moderate
Public date: 2010-10-08T00:00:00+00:00

The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 3 and 4, as they do not include support for the Neptune
Ethernet driver. It did not affect Red Hat Enterprise Linux 5 as it did not contain the upstream commit 0853ad66 that introduced this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ae6df5f96a51818d6376da5307d773baeece4014
CVE-2010-3874: kernel: CAN minor heap overflow
Component: kernel
Severity: Moderate
Public date: 2010-11-02T00:00:00+00:00

Heap-based buffer overflow in the bcm_connect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.36.2 on 64-bit platforms might allow local users to cause a denial of service (memory corruption) via a connect operation.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 did not include CAN bus subsystem support, and therefore are not affected by this issue. Future kernel updates in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 0597d1b99fcfc2c0eada09a698f85ed413d4ba84
CVE-2010-3876: kernel: net/packet/af_packet.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-10-31T00:00:00+00:00

net/packet/af_packet.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_RAW capability to read copies of the applicable structures.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to
this product being in Extended Life Cycle Phase of its maintenance life-cycle,
where only qualified security errata of critical impact are addressed.

For further information about the Errata Support Policy, visit:
http://www.redhat.com/security/updates/errata

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 67286640f638f5ad41a946b9a3dc75327950248f
CVE-2010-3877: kernel: net/tipc/socket.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-10-31T00:00:00+00:00

The get_name function in net/tipc/socket.c in the Linux kernel before 2.6.37-rc2 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory by reading a copy of this structure.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4 and Red Hat Enterprise MRG as they did not include
support for Transparent Inter-Process Communication Protocol (TIPC). A future
kernel update in Red Hat Enterprise Linux 5 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 88f8a5e3e7defccd3925cabb1ee4d3994e5cdb52
CVE-2010-3880: kernel: logic error in INET_DIAG bytecode auditing
Component: kernel
Severity: Moderate
Public date: 2010-11-03T00:00:00+00:00

net/ipv4/inet_diag.c in the Linux kernel before 2.6.37-rc2 does not properly audit INET_DIAG bytecode, which allows local users to cause a denial of service (kernel infinite loop) via crafted INET_DIAG_REQ_BYTECODE instructions in a netlink message that contains multiple attribute elements, as demonstrated by INET_DIAG_BC_JMP instructions.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not include support for monitoring of INET transport protocol sockets. Future updates in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 22e76c849d505d87c5ecf3d3e6742a65f0ff4860
CVE-2010-3881: kvm: arch/x86/kvm/x86.c: reading uninitialized stack memory
Component: kvm
Severity: Low
Public date: 2010-10-30T00:00:00+00:00

arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4 and Red Hat Enterprise MRG as they did not include
support for Kernel-based Virtual Machine (KVM). A future kernel update in Red
Hat Enterprise Linux 5 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 97e69aa62f8b5d338d6cff49be09e37cc1262838
CVE-2010-3904: kernel: RDS sockets local privilege escalation
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2010-10-19T00:00:00+00:00

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and Red Hat Enterprise MRG did not include support for the RDS Protocol, and therefore are not affected by this issue. Updates for Red Hat Enterprise Linux 5 and 6 are available to address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 799c10559d60f159ab2232203f222f18fa3c4a5f
CVE-2010-4015: PostgreSQL: Stack-based buffer overflow by processing certain tokens from SQL query string when intarray module enabled
Component: PostgreSQL
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2011-02-01T00:00:00+00:00

Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions.


Affected upstream versions: n/a
Fixed upstream versions: REL9_1_0
Upstream repository: https://git.postgresql.org/postgresql.git
Upstream fix commit: 7ccb6dc2d3e266a551827bb99179708580f72431
CVE-2010-4072: kernel: ipc/shm.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-10-06T00:00:00+00:00

The copy_shmid_to_user function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface."

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to this product being in Extended Life Cycle Phase of its maintenance life-cycle, where only qualified security errata of critical impact are addressed.
                                   
For further information about the Errata Support Policy, visit:
http://www.redhat.com/security/updates/errata

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 3af54c9bd9e6f14f896aac1bb0e8405ae0bc7a44
CVE-2010-4073: kernel: ipc/compat*.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-10-06T00:00:00+00:00

The ipc subsystem in the Linux kernel before 2.6.37-rc1 does not initialize certain structures, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the (1) compat_sys_semctl, (2) compat_sys_msgctl, and (3) compat_sys_shmctl functions in ipc/compat.c; and the (4) compat_sys_mq_open and (5) compat_sys_mq_getsetattr functions in ipc/compat_mq.c.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3 as it did not include IPC compat functionality.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 03145beb455cf5c20a761e8451e30b8a74ba58d9
CVE-2010-4074: kernel: drivers/usb/serial/mos*.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-15T00:00:00+00:00

The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4, and 5 as they did not include support for Moschip USB
serial port adapters.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a0846f1868b11cd827bdfeaf4527d8b1b1c0b098
CVE-2010-4075: kernel: drivers/serial/serial_core.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-15T00:00:00+00:00

The uart_get_count function in drivers/serial/serial_core.c in the Linux kernel before 2.6.37-rc1 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3 as it did not include the affected functionality.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d281da7ff6f70efca0553c288bb883e8605b3862
CVE-2010-4077: kernel: drivers/char/nozomi.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-15T00:00:00+00:00

The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4, and 5 as they did not include support for GlobeTrotter
HSPDA PCMCIA card.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d281da7ff6f70efca0553c288bb883e8605b3862
CVE-2010-4079: kernel: drivers/video/ivtv/ivtvfb.c: reading uninitialized stack memory
Component: kernel
Severity: Low
Public date: 2010-09-15T00:00:00+00:00

The ivtvfb_ioctl function in drivers/media/video/ivtv/ivtvfb.c in the Linux kernel before 2.6.36-rc8 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FBIOGET_VBLANK ioctl call.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4, and 5 as they did not include support for the Conexant's
CX23415/CX23416 codec chip.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 405707985594169cfd0b1d97d29fcb4b4c6f2ac9