huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-5770: php: Int/size_t confusion in SplFileObject::fread
Component: php
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-06-23T00:00:00+00:00

A type confusion issue was found in the SPLFileObject fread() function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 7245bff300d3fa8bacbef7897ff080a6f1c23eba
CVE-2016-5771: php: Use After Free Vulnerability in PHP's GC algorithm and unserialize
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-06-23T00:00:00+00:00

spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 3f627e580acfdaf0595ae3b115b8bec677f203ee
CVE-2016-5772: php: Double Free Corruption in wddx_deserialize
Component: php
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-06-23T00:00:00+00:00

Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: a44c89e8af7c2410f4bfc5e097be2a5d0639a60c
CVE-2016-5773: php: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-06-23T00:00:00+00:00

php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: f6aef68089221c5ea047d4a74224ee3deead99a6
CVE-2016-5829: kernel: Heap buffer overflow in hiddev driver
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-06-25T00:00:00+00:00

A heap-based buffer overflow vulnerability was found in the Linux kernel's hiddev driver. This flaw could allow a local attacker to corrupt kernel memory, possible privilege escalation or crashing the system.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2 and may be addressed in future updates. 

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.7
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 93a2001bdfd5376c3dc2158653034c20392d15c5
CVE-2016-5844: libarchive: undefined behaviour (integer overflow) in iso parser
Component: libarchive
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-06-24T00:00:00+00:00

Undefined behavior (signed integer overflow) was discovered in libarchive, in the ISO parser.  A crafted file could potentially cause denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v3.2.1
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: 3ad08e01b4d253c66ae56414886089684155af22
CVE-2016-6128: gd: Invalid color index not properly handled
Component: gd
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-06-27T00:00:00+00:00

It was found that libgd did not properly handle invalid color indexes in GD files.  An attacker who could submit a crafted GD file for conversion could cause applications using libgd to crash, leading to denial of service.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: gd-2.3.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: 6ff72ae40c7c20ece939afb362d98cc37f4a1c96
CVE-2016-6136: kernel: Race condition vulnerability in execve argv arguments
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2016-07-04T00:00:00+00:00

When creating audit records for parameters to executed children processes, an attacker can convince the Linux kernel audit subsystem can create corrupt records which may allow an attacker to misrepresent or evade logging of executing commands.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and 7. This has been rated as having Moderate security impact and is  planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.8
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 43761473c254b45883a64441dd0bc85a42f3645c
CVE-2016-6186: django: XSS in admin's add/change related popup
Component: django
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2016-07-18T00:00:00+00:00

A cross-site scripting (XSS) flaw was found in Django. An attacker could exploit the unsafe usage of JavaScript's Element.innerHTML to forge content in the admin's add/change related pop-up. Element.textContent is now used to prevent XSS data execution.


Affected upstream versions: n/a
Fixed upstream versions: stable/1.8.x
Upstream repository: https://github.com/django/django
Upstream fix commit: f68e5a99164867ab0e071a936470958ed867479d
CVE-2016-6197: kernel: overlayfs: missing upper dentry verification before unlink and rename
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-11T00:00:00+00:00

It was found that the unlink and rename functionality in overlayfs did not verify the upper dentry for staleness. A local, unprivileged user could use the rename syscall on overlayfs on top of xfs to panic or crash the system.

Statement: This issue is not present in the Linux kernel packages as shipped with Red Hat Enterprise Linux versions 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 11f3710417d026ea2f4fcf362d866342c5274185
CVE-2016-6198: kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-11T00:00:00+00:00

A flaw was found that the vfs_rename() function did not detect hard links on overlayfs. A local, unprivileged user could use the rename syscall on overlayfs on top of xfs to crash the system.

Statement: This issue is not present in the Linux kernel packages as shipped with Red Hat Enterprise Linux versions 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 9409e22acdfc9153f88d9b1ed2bd2a5b34d2d3ca
CVE-2016-6213: kernel: Overflowing kernel mount table using shared bind mount
Component: kernel
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-13T00:00:00+00:00

It was found that in Linux kernel the mount table expands by a power-of-two with each bind mount command. If a system is configured to allow non-privileged user to do bind mounts, or allows to do so in a container or unprivileged mount namespace, then non-privileged user is able to cause a local DoS by overflowing the mount table, which causes a deadlock for the whole system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG-2 as of now due to the absence of unprivileged mount name spaces support.

Nevertheless, the unprivileged mount name spaces might be added to a future RHEL-7 version as a supported feature, so future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d29216842a85c7970c536108e093963f02714498
CVE-2016-6250: libarchive: Buffer overflow when writing large iso9660 containers
Component: libarchive
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.9 (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L)
Public date: 2016-05-29T00:00:00+00:00

A vulnerability was found in libarchive. An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash.


Affected upstream versions: n/a
Fixed upstream versions: v3.2.1
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: 3014e198
CVE-2016-6288: php: Buffer over-read in php_url_parse_ex
Component: php
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2015-09-13T00:00:00+00:00

The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.


Affected upstream versions: n/a
Fixed upstream versions: php-5.6.15
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 629e4da7cc8b174acdeab84969cbfc606a019b31
CVE-2016-6289: php: Integer overflow leads to buffer overflow in virtual_file_ex
Component: php
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-06-29T00:00:00+00:00

Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 0218acb7e756a469099c4ccfb22bce6c2bd1ef87
CVE-2016-6290: php: Use after free in unserialize() with Unexpected Session Deserialization
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-07-08T00:00:00+00:00

ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 3798eb6fd5dddb211b01d41495072fd9858d4e32
CVE-2016-6291: php: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE
Component: php
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2016-07-15T00:00:00+00:00

The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: eebcbd5de38a0f1c2876035402cb770e37476519
CVE-2016-6292: php: Null pointer dereference in exif_process_user_comment
Component: php
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-19T00:00:00+00:00

The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 41131cd41d2fd2e0c2f332a27988df75659c42e4
CVE-2016-6294: php: Out-of-bounds access in locale_accept_from_http
Component: php
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2016-07-03T00:00:00+00:00

The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
CVE-2016-6295: php: Use after free in SNMP with GC and unserialize()
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-06-23T00:00:00+00:00

ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: cab1c3b3708eead315e033359d07049b23b147a3
CVE-2016-6296: php: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c
Component: php
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-07-17T00:00:00+00:00

Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: e6c48213c22ed50b2b987b479fcc1ac709394caa
CVE-2016-6297: php: Stack-based buffer overflow vulnerability in php_stream_zip_opener
Component: php
Severity: Low
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.4 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-06-30T00:00:00+00:00

Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.38
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 81406c0c1d45f75fcc7972ed974d2597abb0b9e9
CVE-2016-6302: openssl: Insufficient TLS session ticket HMAC length checks
Component: openssl
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-08-23T00:00:00+00:00

An integer underflow flaw leading to a buffer over-read was found in the way OpenSSL parsed TLS session tickets. A remote attacker could use this flaw to crash a TLS server using OpenSSL if it used SHA-512 as HMAC for session tickets.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: e97763c92c655dcf4af2860b3abd2bc4c8a267f9
CVE-2016-6304: openssl: OCSP Status Request extension unbounded memory growth
Component: openssl
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-22T00:00:00+00:00

A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.

Statement: TLS server applications using OpenSSL versions in Red Hat Enterprise Linux 6 and 7 are only affected if they enable OCSP stapling support. Applications not enabling OCSP stapling support are not affected. Few applications implement OCSP stapling support and typically do not enable it by default.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1u
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 2c0d295e26306e15a92eb23a84a1802005c1c137
CVE-2016-6306: openssl: certificate message OOB reads
Component: openssl
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-09-21T00:00:00+00:00

Multiple out of bounds read flaws were found in the way OpenSSL handled certain TLS/SSL protocol handshake messages. A remote attacker could possibly use these flaws to crash a TLS/SSL server or client using OpenSSL.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_1u
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 52e623c4cb06fffa9d5e75c60b34b4bc130b12e9
CVE-2016-6319: foreman: Persistent XSS in Foreman remote execution plugin
Component: foreman
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2016-08-09T00:00:00+00:00

It was found that foreman is vulnerable to a stored XSS via a job template with a malformed name. This could allow an attacker with privileges to set the name in a template to display arbitrary HTML including scripting code within the web interface.


Affected upstream versions: n/a
Fixed upstream versions: 1.13.0
Upstream repository: https://github.com/theforeman/foreman
Upstream fix commit: 0f35fe14acf0d0d3b55e9337bc5e2b9640ff2372
CVE-2016-6320: satellite6: stored XSS while provisioning new host
Component: satellite6
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2016-08-10T00:00:00+00:00

A cross-site scripting (XSS) flaw was found in the "Device Identifier" field of the new host provisioning components of Red Hat Satellite. A user able to create a new host could exploit this flaw to perform XSS attacks against other Satellite users.


Affected upstream versions: n/a
Upstream repository: https://github.com/theforeman/foreman
Upstream fix commit: 850c38451c7bbde75521b796d16aca26e4d240a0
CVE-2016-6327: kernel: infiniband: Kernel crash by sending ABORT_TASK command
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-08-19T00:00:00+00:00

System using the infiniband support module ib_srpt were vulnerable to a denial of service by system crash by a local attacker who is able to abort writes to a device using this initiator.

Statement: This issue affects Red Hat Enterprise Linux 7 and MRG-2 kernels and will be addressed in a future update.  This issue does not affect Red Hat Enterprise Linux 5 and 6 systems.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 51093254bf879bc9ce96590400a87897c7498463
CVE-2016-6489: nettle: RSA/DSA code is vulnerable to cache-timing related attacks
Component: nettle
Severity: Moderate
CVSS v3: 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2016-06-20T00:00:00+00:00

It was found that nettle's RSA and DSA decryption code was vulnerable to cache-related side channel attacks. An attacker could use this flaw to recover the private key from a co-located virtual-machine instance.


Affected upstream versions: n/a
Fixed upstream versions: nettle_3.3_release_20161001
Upstream repository: https://git.lysator.liu.se/nettle/nettle
Upstream fix commit: 3fe1d6549765ecfb24f0b80b2ed086fdc818bff3