huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2011-0999: kernel: thp: prevent hugepages during args/env copying into the user stack
Component: kernel
Severity: Moderate
Public date: 2011-02-15T00:00:00+00:00

mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application.

Statement: This issue only affects Red Hat Enterprise Linux 6. The version of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG as they did not include upstream commit 71e3aac0 that introduced the problem. We have addressed this in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-0542.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a7d6e4ecdb7648478ddec76d30d87d03d6e22b31
CVE-2011-10007: perl-file-find-rule: File::Find::Rule Arbitrary Code Execution
Component: perl-file-find-rule
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-06-05T11:57:58.654000+00:00

A flaw was found in perl-file-find-rule. The `grep()` function within `File::Find::Rule` versions up to 0.34 is vulnerable to arbitrary code execution if provided with a specially crafted filename. This vulnerability allows an attacker to supply a filename that, when opened, executes arbitrary code via the `open()` function's mode parameter. Consequently, an attacker can achieve remote code execution by providing a malicious filename.

Statement: This vulnerability marked as Important rather than Moderate because it enables arbitrary code execution (ACE) through a common and trusted interface—filename handling. Specifically, the use of Perl’s two-argument open() within the grep() method allows attacker-controlled filenames to be interpreted as shell commands when prefixed with special characters like |. Since File::Find::Rule is often used in automation scripts, system utilities, and recursive file operations, this flaw transforms a seemingly benign filename input into an execution vector, violating a core security boundary between data and code. The vulnerability does not require elevated privileges or complex exploitation chains; a single crafted filename is enough to trigger shell execution, making the flaw exploitable in real-world scenarios such as CI/CD pipelines or file indexing systems.

Affected upstream versions: <= release-0.34
Upstream repository: https://github.com/richardc/perl-file-find-rule
Upstream fix commit: df58128bcee4c1da78c34d7f3fe1357e575ad56f
CVE-2011-1002: avahi: daemon infinite loop triggered by an empty UDP packet (CVE-2010-2244 fix regression)
Component: avahi
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2011-01-04T00:00:00+00:00

avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.


Affected upstream versions: n/a
Upstream repository: https://git.0pointer.de/avahi.git
Upstream fix commit: 46109dfec75534fe270c0ab902576f685d5ab3a6
CVE-2011-1006: libcgroup: Heap-based buffer overflow by converting list of controllers for given task into an array of strings
Component: libcgroup
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2011-03-03T00:00:00+00:00

Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application.  NOTE: it is not clear whether this issue crosses privilege boundaries.


Affected upstream versions: n/a
Upstream repository: https://libcg.git.sourceforge.net/git/libcg/libcg
Upstream fix commit: 5ae8aea1ecd60c439121d3329d8eaabf13d292c1
CVE-2011-1010: kernel: fs/partitions: Validate map_count in Mac partition tables
Component: kernel
Severity: Low
Public date: 2011-02-17T00:00:00+00:00

Buffer overflow in the mac_partition function in fs/partitions/mac.c in the Linux kernel before 2.6.37.2 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via a malformed Mac OS partition table.

Statement: This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0429.html, https://rhn.redhat.com/errata/RHSA-2011-0542.html and https://rhn.redhat.com/errata/RHSA-2011-0500.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: fa7ea87a057958a8b7926c1a60a3ca6d696328ed
CVE-2011-1011: policycoreutils: insecure temporary directory handling in seunshare
Component: policycoreutils
Severity: Important
Public date: 2011-02-22T00:00:00+00:00

The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.


Affected upstream versions: n/a
Upstream repository: https://pkgs.fedoraproject.org/gitweb/policycoreutils.git
Upstream fix commit: d4db5bc06027de23d12a4b3f18fa6f9b1517df27
CVE-2011-1013: kernel: drm_modeset_ctl signedness issue
Component: kernel
Severity: Important
Public date: 2011-02-22T00:00:00+00:00

Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 4, 5 as they did not include the affected functionality. A future update in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1922756124ddd53846877416d92ba4a802bc658f
CVE-2011-1016: kernel: drm/radeon/kms: check AA resolve registers on r300
Component: kernel
Severity: Important
Public date: 2011-02-14T00:00:00+00:00

The Radeon GPU drivers in the Linux kernel before 2.6.38-rc5 do not properly validate data related to the AA resolve registers, which allows local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and Red Hat Enterprise MRG as they did not backport the upstream commits fff1ce4d and 45e4039c that introduced this issue. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2011-0498.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: fff1ce4dc6113b6fdc4e3a815ca5fd229408f8ef
CVE-2011-1019: kernel: CAP_SYS_MODULE bypass via CAP_NET_ADMIN
Component: kernel
Severity: Low
Public date: 2011-02-24T00:00:00+00:00

The dev_load function in net/core/dev.c in the Linux kernel before 2.6.38 allows local users to bypass an intended CAP_SYS_MODULE capability requirement and load arbitrary modules by leveraging the CAP_NET_ADMIN capability.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport the upstream commit a8f80e8f that introduced this flaw. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0498.html and https://rhn.redhat.com/errata/RHSA-2011-0500.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8909c9ad8ff03611c9c96c9a92656213e4bb495b
CVE-2011-1021: kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
Component: kernel
Severity: Moderate
Public date: 2011-02-22T00:00:00+00:00

drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4347.

Statement: The version of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and 6 as they did not include upstream commit a1a541d8 and a25ee920 that introduced the problem. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Notes:

This requires debugfs to be mounted on a local system in order to have access
to the custom_method file. Debugfs is not mounted by default. You need to run
"mount -t debugfs nodev /sys/kernel/debug" as root first.

Affected upstream versions: n/a
Fixed upstream versions: v3.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 526b4af47f44148c9d665e57723ed9f86634c6e3
CVE-2011-1023: kernel: BUG_ON() in rds_send_xmit()
Component: kernel
Severity: Moderate
Public date: 2011-03-02T00:00:00+00:00

The Reliable Datagram Sockets (RDS) subsystem in the Linux kernel before 2.6.38 does not properly handle congestion map updates, which allows local users to cause a denial of service (BUG_ON and system crash) via vectors involving (1) a loopback (aka loop) transmit operation or (2) an InfiniBand (aka ib) transmit operation.

Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG did not include support for the RDS Protocol, and therefore are
not affected by this issue. The Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6 are not affected as they did not backport upstream commit 2e7b3b99 and 77dd550e that introduced this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6094628bfd94323fc1cea05ec2c6affd98c18f7f
CVE-2011-1044: kernel: IB/uverbs: Handle large number of entries in poll CQ
Component: kernel
Severity: Important
Public date: 2010-12-08T00:00:00+00:00

The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 7182afea8d1afd432a17c18162cc3fd441d0da93
CVE-2011-1071: glibc: fnmatch() alloca()-based memory corruption flaw
Component: glibc
Severity: Low
Public date: 2010-08-05T00:00:00+00:00

The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.13
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: f15ce4d8dc139523fe0c273580b604b2453acba6
CVE-2011-1078: kernel: bt sco_conninfo infoleak
Component: kernel
Severity: Low
Public date: 2011-02-14T00:00:00+00:00

The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c4c896e1471aec3b004a693c689f60be3b17ac86
CVE-2011-1079: kernel: bnep device field missing NULL terminator
Component: kernel
Severity: Moderate
Public date: 2011-02-14T00:00:00+00:00

The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 43629f8f5ea32a998d06d1bb41eefa0e821ff573
CVE-2011-1080: kernel: ebtables stack infoleak
Component: kernel
Severity: Low
Public date: 2011-02-14T00:00:00+00:00

The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d846f71195d57b0bbb143382647c2c6638b04c5a
CVE-2011-1082: kernel: potential kernel deadlock when creating circular epoll file structures
Component: kernel
Severity: Moderate
Public date: 2011-02-05T00:00:00+00:00

fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.

Statement: This issue does not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5. This was addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0542.html and https://rhn.redhat.com/errata/RHSA-2011-0500.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e
CVE-2011-1090: kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab
Component: kernel
Severity: Moderate
Public date: 2011-03-05T00:00:00+00:00

The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not backport the upstream commit 4b580ee3 that introduced this issue. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0429.html, https://rhn.redhat.com/errata/RHSA-2011-0542.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e9e3d724e2145f5039b423c290ce2b2c3d8f94bc
CVE-2011-1093: kernel: dccp: fix oops on Reset after close
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2011-03-02T00:00:00+00:00

The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not include support for the DCCP protocol. Future updates in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 720dc34bbbe9493c7bd48b2243058b4e447a929d
CVE-2011-1097: rsync: Incremental file-list corruption due to temporary file_extra_cnt increments
Component: rsync
Severity: Moderate
Public date: 2011-03-26T00:00:00+00:00

rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.


Affected upstream versions: n/a
Fixed upstream versions: v3.0.8
Upstream repository: https://gitweb.samba.org/rsync.git
Upstream fix commit: 83b94efa6b60a3ff5eee4c5f7812c617a90a03f6
CVE-2011-1146: libvirt: several API calls do not honour read-only connection
Component: libvirt
Severity: Important
Public date: 2011-03-02T00:00:00+00:00

libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.


Affected upstream versions: n/a
Fixed upstream versions: v0.9.0
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: 71753cb7f7a16ff800381c0b5ee4e99eea92fed3
CVE-2011-1160: kernel: tpm infoleaks
Component: kernel
Severity: Low
Public date: 2011-03-08T00:00:00+00:00

The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1309d7afbed112f0e8e90be9af975550caa0076b
CVE-2011-1163: kernel: fs/partitions: Corrupted OSF partition table infoleak
Component: kernel
Severity: Low
Public date: 2011-03-15T00:00:00+00:00

The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.

Statement: This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0833.html, https://rhn.redhat.com/errata/RHSA-2011-0542.html, and https://rhn.redhat.com/errata/RHSA-2011-0500.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for
this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.38
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1eafbfeb7bdf59cfe173304c76188f3fd5f1fd05
CVE-2011-1165: vino-preferences does not warn about UPnP especially with no password and no confirmation.
Component: vino-preferences does not warn about UPnP especially with no password and no confirmation.
Severity: Low
Public date: 2009-09-08T00:00:00+00:00

Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accept connections" setting is enabled, which might make it easier for remote attackers to perform further attacks.

Statement: This issue did not affect the version of vino as shipped with Red Hat Enterprise Linux 4 or 5 as they did not include support for Universal Plug and Play (UPnP).  A future update in Red Hat Enterprise Linux 6 may address this flaw.  To mitigate this issue, users should ensure that confirmation is requested on each inbound connection attempt, that a password is required to connect, and that automatic network configuration is disabled.  This will prevent vino from using UPnP to allow access to the VNC port, and will ensure that any connections require a password and that the user is notified on any connection attempts.

Affected upstream versions: n/a
Fixed upstream versions: 3.1.1
Upstream repository: https://git.gnome.org/browse/vino
Upstream fix commit: 410bbf8e284409bdef02322af4d4a3a388419566
CVE-2011-1170: kernel: ipv4: netfilter: arp_tables: fix infoleak to userspace
Component: kernel
Severity: Low
Public date: 2011-03-10T00:00:00+00:00

net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.

Statement: Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance
life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore
the fix for this issue is not currently planned to be included in the future
updates. Future kernel updates in Red Hat Enterprise Linux 5, 6 and Red Hat
Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 42eab94fff18cb1091d3501cd284d6bd6cc9c143