huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2014-4655: Kernel: ALSA: control: use-after-free in replacing user controls
Component: Kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2014-06-18T00:00:00+00:00

A use-after-free flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 82262a46627bebb0febcc26664746c25cef08563
CVE-2014-4656: Kernel: ALSA: control: integer overflow in id.index & id.numid
Component: Kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-06-18T00:00:00+00:00

An integer overflow flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ac902c112d90a89e59916f751c2745f4dbdbb4bd
CVE-2014-4667: kernel: sctp: sk_ack_backlog wrap-around problem
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-06-12T00:00:00+00:00

An integer underflow flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation processed certain COOKIE_ECHO packets. By sending a specially crafted SCTP packet, a remote attacker could use this flaw to prevent legitimate connections to a particular SCTP server socket to be made.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d3217b15a19a4779c39b212358a5c71d725822ee
CVE-2014-4699: kernel: x86_64: ptrace: sysret to non-canonical address
Component: kernel
Severity: Important
CWE: CWE-642 (External Control of Critical State Data)
Public date: 2014-07-04T00:00:00+00:00

It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory address without forcing the non-sysret code path when returning to user space. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

Note: The CVE-2014-4699 issue only affected systems using an Intel CPU.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a
CVE-2014-4877: wget: FTP symlink arbitrary filesystem access
Component: wget
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
Public date: 2014-10-27T00:00:00+00:00

A flaw was found in the way Wget handled symbolic links. A malicious FTP server could allow Wget running in the mirror mode (using the '-m' command line option) to write an arbitrary file to a location writable to by the user running Wget, possibly leading to code execution.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/wget.git
Upstream fix commit: b4440d96cf8173d68ecaa07c36b8f4316ee794d0
CVE-2014-4943: kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
Component: kernel
Severity: Important
Public date: 2014-07-16T00:00:00+00:00

A flaw was found in the way the pppol2tp_setsockopt() and pppol2tp_getsockopt() functions in the Linux kernel's PPP over L2TP implementation handled requests with a non-SOL_PPPOL2TP socket option level. A local, unprivileged user could use this flaw to escalate their privileges on the system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Please note that on Red Hat Enterprise Linux 6 pppol2tp module is not
automatically loaded when AF_PPPOX/PX_PROTO_OL2TP socket is created as
Red Hat Enterprise Linux 6 lacks upstream commit 9395a09d05a23bb and default
modprobe configuration as shipped with module-init-tools package does not
contain the alias for pppol2tp protocol either. As a result, pppol2tp module
has to be explicitly enabled and/or loaded by the system administrator.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
CVE-2014-5033: polkit-qt: insecure calling of polkit
Component: polkit-qt
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
Public date: 2014-03-24T00:00:00+00:00

It was found that polkit-qt handled authorization requests with PolicyKit via a D-Bus API that is vulnerable to a race condition. A local user could use this flaw to bypass intended PolicyKit authorizations.


Affected upstream versions: n/a
Upstream repository: https://quickgit.kde.org/kdelibs.git
Upstream fix commit: e4e7b53b71e2659adaf52691d4accc3594203b23
CVE-2014-5045: kernel: vfs: refcount issues during unmount on symlink
Component: kernel
Severity: Moderate
Public date: 2014-07-20T00:00:00+00:00

A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation.

Statement: This issue does not affect Linux kernel packages as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Future Linux kernel updates for Red Hat Enterprise Linux 6 and 7 may address
this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 295dc39d941dc2ae53d5c170365af4c9d5c16212
CVE-2014-5077: Kernel: net: SCTP: fix a NULL pointer dereference during INIT collisions
Component: Kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-07-17T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as it doesn't provide support for AUTH chunks.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and 7. Future kernel updates for Red Hat Enterprise Linux 6 and 7 may address this issue. This issue has been fixed in Red Hat Enterprise MRG via RHSA-2014:1083.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1be9a950c646c9092fb3618197f7b6bfb50e82aa
CVE-2014-5256: V8: Memory Corruption and Stack Overflow
Component: V8
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2014-07-31T00:00:00+00:00

It was discovered that V8 did not properly check the stack size limit in certain cases. A remote attacker able to send a request that caused a script executed by V8 to use deep recursion could trigger a stack overflow, leading to a crash of an application using V8.

Statement: Red Hat Product Security has rated this issue as having Low security impact in Red Hat Enterprise Linux OpenStack Platform. This issue is not currently planned to be addressed in a future security update.

Red Hat Satellite 6.5 ship v8 however has been rated as a security impact of Moderate, product version Satellite 6.6 onward is not affected. Satellite 6.5 is in Maintenance Support phase of the product life cycle and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 6 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.

Affected upstream versions: n/a
Fixed upstream versions: v0.10.30
Upstream repository: https://github.com/joyent/node
Upstream fix commit: 530af9cb8e700e7596b3ec812bad123c9fa06356
CVE-2014-5352: krb5: gss_process_context_token() incorrectly frees context (MITKRB5-SA-2015-001)
Component: krb5
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2015-02-03T00:00:00+00:00

A use-after-free flaw was found in the way the MIT Kerberos libgssapi_krb5 library processed valid context deletion tokens. An attacker able to make an application using the GSS-API library (libgssapi) call the gss_process_context_token() function could use this flaw to crash that application.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.14-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 82dc33da50338ac84c7b4102dc6513d897d0506a
CVE-2014-5353: krb5: NULL pointer dereference when using a ticket policy name as a password policy name
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-12-06T00:00:00+00:00

If kadmind were used with an LDAP back end for the KDC database, a remote, authenticated attacker who has the permissions to set the password policy could crash kadmind by attempting to use a named ticket policy object as a password policy for a principal.

Statement: This issue affects the version of krb5 package as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not planned to be addressed in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.14-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: d1f707024f1d0af6e54a18885322d70fa15ec4d3
CVE-2014-5355: krb5: unauthenticated denial of service in recvauth_common() and others
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-12-09T00:00:00+00:00

It was found that the krb5_read_message() function of MIT Kerberos did not correctly sanitize input, and could create invalid krb5_data objects. A remote, unauthenticated attacker could use this flaw to crash a Kerberos child process via a specially crafted request.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.14-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 102bb6ebf20f9174130c85c3b052ae104e5073ec
CVE-2014-5471: kernel: isofs: unbound recursion when processing relocated directories
Component: kernel
Severity: Low
Public date: 2014-08-26T00:00:00+00:00

It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v3.17
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 410dd3cf4c9b36f27ed4542ee18b1af5e68645a4
CVE-2014-5472: kernel: isofs: unbound recursion when processing relocated directories
Component: kernel
Severity: Low
Public date: 2014-08-26T00:00:00+00:00

It was found that the parse_rock_ridge_inode_internal() function of the Linux kernel's ISOFS implementation did not correctly check relocated directories when processing Rock Ridge child link (CL) tags. An attacker with physical access to the system could use a specially crafted ISO image to crash the system or, potentially, escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v3.17
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 410dd3cf4c9b36f27ed4542ee18b1af5e68645a4
CVE-2014-6040: glibc: crash in code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364)
Component: glibc
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2014-08-28T00:00:00+00:00

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.

Statement: This issue affects the version of glibc package as shipped with Red Hat Enterprise Linux 5.

Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.20
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 41488498b6
CVE-2014-6051: libvncserver: integer overflow flaw, leading to a heap-based buffer overflow in screen size handling
Component: libvncserver
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-09-23T00:00:00+00:00

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way screen sizes were handled by LibVNCServer. A malicious VNC server could use this flaw to cause a client to crash or, potentially, execute arbitrary code in the client.


Affected upstream versions: n/a
Upstream repository: https://github.com/newsoft/libvncserver
Upstream fix commit: 045a044e8ae79db9244593fbce154cdf6e843273
CVE-2014-6052: libvncserver: NULL pointer dereference flaw in framebuffer setup
Component: libvncserver
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-09-23T00:00:00+00:00

A NULL pointer dereference flaw was found in LibVNCServer's framebuffer setup. A malicious VNC server could use this flaw to cause a VNC client to crash.


Affected upstream versions: n/a
Upstream repository: https://github.com/newsoft/libvncserver
Upstream fix commit: 85a778c0e45e87e35ee7199f1f25020648e8b812
CVE-2014-6053: libvncserver: server NULL pointer dereference flaw in ClientCutText message handling
Component: libvncserver
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-09-23T00:00:00+00:00

A NULL pointer dereference flaw was found in the way LibVNCServer handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Upstream repository: https://github.com/newsoft/libvncserver
Upstream fix commit: 6037a9074d52b1963c97cb28ea1096c7c14cbf28
CVE-2014-6054: libvncserver: server divide-by-zero flaw in scaling factor handling
Component: libvncserver
Severity: Moderate
CWE: CWE-369 (Divide By Zero)
Public date: 2014-09-23T00:00:00+00:00

A divide-by-zero flaw was found in the way LibVNCServer handled the scaling factor when it was set to "0". A remote attacker could use this flaw to crash the VNC server using a malicious VNC client.


Affected upstream versions: n/a
Upstream repository: https://github.com/newsoft/libvncserver
Upstream fix commit: 05a9bd41a8ec0a9d580a8f420f41718bdd235446
CVE-2014-6055: libvncserver: server stacked-based buffer overflow flaws in file transfer handling
Component: libvncserver
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
Public date: 2014-09-23T00:00:00+00:00

Two stack-based buffer overflow flaws were found in the way LibVNCServer handled file transfers. A remote attacker could use this flaw to crash the VNC server using a malicious VNC client.


Affected upstream versions: n/a
Upstream repository: https://github.com/newsoft/libvncserver
Upstream fix commit: f528072216dec01cee7ca35d94e171a3b909e677
CVE-2014-6269: haproxy: remote client denial of service vulnerability
Component: haproxy
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
Public date: 2014-08-05T00:00:00+00:00

A buffer overflow flaw was discovered in the way HAProxy handled, under very specific conditions, data uploaded from a client. A remote attacker could possibly use this flaw to crash HAProxy.


Affected upstream versions: n/a
Fixed upstream versions: v1.5.4
Upstream repository: https://git.haproxy.org/haproxy-1.5.git
Upstream fix commit: b4d05093bc89f71377230228007e69a1434c1a0c
CVE-2014-6410: kernel: udf: Avoid infinite loop when processing indirect ICBs
Component: kernel
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2014-09-15T00:00:00+00:00

A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's Universal Disk Format (UDF) file system implementation processed indirect Information Control Blocks (ICBs). An attacker with physical access to the system could use a specially crafted UDF image to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v3.17
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c03aa9f6e1f938618e6db2e23afef0574efeeb65
CVE-2014-6421: wireshark: RTP dissector crash (wnpa-sec-2014-12)
Component: wireshark
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2014-03-23T00:00:00+00:00

Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 04c05a21e34cec326f1aff2f5f8a6e74e1ced984
CVE-2014-6422: wireshark: RTP dissector crash (wnpa-sec-2014-12)
Component: wireshark
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2014-03-23T00:00:00+00:00

The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 04c05a21e34cec326f1aff2f5f8a6e74e1ced984
CVE-2014-6423: wireshark: MEGACO dissector infinite loop (wnpa-sec-2014-13)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2014-08-01T00:00:00+00:00

The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 9112a099d7cc2cd924b7c667bf27f6e112b970c6
CVE-2014-6424: wireshark: Netflow dissector crash (wnpa-sec-2014-14)
Component: wireshark
Severity: Moderate
Public date: 2014-08-13T00:00:00+00:00

The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 44698259b1f5865c60323acaf2a633654a2abe81
CVE-2014-6425: wireshark: CUPS dissector crash (wnpa-sec-2014-15)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2014-08-07T00:00:00+00:00

The (1) get_quoted_string and (2) get_unquoted_string functions in epan/dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing '\0' character.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: c10396dbbf782a576bc1f9a931cf86090cec3878
CVE-2014-6426: wireshark: HIP dissector infinite loop (wnpa-sec-2014-16)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2014-08-14T00:00:00+00:00

The dissect_hip_tlv function in epan/dissectors/packet-hip.c in the HIP dissector in Wireshark 1.12.x before 1.12.1 does not properly handle a NULL tree, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: d9e5021fe79973d00ddd8fcef0bbefbaae63dd0f
CVE-2014-6427: wireshark: RTSP dissector crash (wnpa-sec-2014-17)
Component: wireshark
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2014-08-14T00:00:00+00:00

Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 73959159dbf34b4a0b50fbd19e05cb1b470be9b0