huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2012-3492: condor: lock directories created mode 0777 allow for FS-based authentication challenge bypass
Component: condor
Severity: Moderate
Public date: 2012-09-19T00:00:00+00:00

The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.


Affected upstream versions: n/a
Upstream repository: https://condor-git.cs.wisc.edu/condor.git
Upstream fix commit: 1db67805
CVE-2012-3493: condor: GIVE_REQUEST_AD leaks privileged ClaimId information
Component: condor
Severity: Moderate
Public date: 2012-09-19T00:00:00+00:00

The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which leaks the ClaimId.


Affected upstream versions: n/a
Upstream repository: https://condor-git.cs.wisc.edu/condor.git
Upstream fix commit: d2f33972
CVE-2012-3503: Katello: Application.config.secret_token is not generated properly
Component: Katello
Severity: Low
Public date: 2012-08-21T00:00:00+00:00

The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.


Affected upstream versions: n/a
Fixed upstream versions: katello-agent-1.1.1-1
Upstream repository: https://github.com/Katello/katello
Upstream fix commit: 7c256fef9d75029d0ffff58ff1dcda915056d3a3
CVE-2012-3510: kernel: taskstats: use-after-free in xacct_add_tsk()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2006-10-30T00:00:00+00:00

Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red 
Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they already contain 
upstream commit f0ec1aaf54cadd that fixed this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f0ec1aaf54caddd21c259aea8b2ecfbde4ee4fb9
CVE-2012-3511: kernel: mm: use-after-free in madvise_remove()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2012-07-06T00:00:00+00:00

Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.


Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb
CVE-2012-3520: kernel: af_netlink: invalid handling of SCM_CREDENTIALS passing
Component: kernel
Severity: Important
Public date: 2012-08-21T00:00:00+00:00

The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6 as they did not backport the commit that introduced this issue. Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea
CVE-2012-3525: jabberd: Prone to unsolicited XMPP Dialback attacks
Component: jabberd
Severity: Low
Public date: 2012-08-21T00:00:00+00:00

s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: jabberd-2.2.17
Upstream repository: https://github.com/Jabberd2/jabberd2
Upstream fix commit: aabcffae560d5fd00cd1d2ffce5d760353cf0a4d
CVE-2012-3540: OpenStack-Horizon: Open redirect through 'next' parameter
Component: OpenStack-Horizon
Severity: Low
Public date: 2012-08-30T00:00:00+00:00

Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.


Affected upstream versions: n/a
Fixed upstream versions: 2012.1.3
Upstream repository: https://github.com/openstack/horizon
Upstream fix commit: 35eada8a27323c0f83c400177797927aba6bc99b
CVE-2012-3542: Keystone: Lack of authorization for adding users to tenants
Component: Keystone
Severity: Important
Public date: 2012-08-30T00:00:00+00:00

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.


Affected upstream versions: n/a
Fixed upstream versions: grizzly-1
Upstream repository: https://github.com/openstack/keystone
Upstream fix commit: c13d0ba606f7b2bdc609a7f388334e5efec3f3aa
CVE-2012-3552: kernel: net: slab corruption due to improper synchronization around inet->opt
Component: kernel
Severity: Moderate
Public date: 2011-04-21T00:00:00+00:00

Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.

Statement: This issue did affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue did affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6.

This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterpise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f6d8bd051c391c1c0458a30b2a7abcd939329259
CVE-2012-3864: puppet: authenticated clients allowed to read arbitrary files from the puppet master
Component: puppet
Severity: Low
Public date: 2012-07-10T00:00:00+00:00

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.


Affected upstream versions: n/a
Fixed upstream versions: 1.5.2
Upstream repository: https://github.com/puppetlabs/puppet
Upstream fix commit: 10f6cb8969b4d5a933b333ecb01ce3696b1d57d4
CVE-2012-3865: puppet: authenticated clients allowed to delete arbitrary files on the puppet master
Component: puppet
Severity: Low
Public date: 2012-07-10T00:00:00+00:00

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.


Affected upstream versions: n/a
Fixed upstream versions: 2.6.17
Upstream repository: https://github.com/puppetlabs/puppet
Upstream fix commit: 554eefc55f57ed2b76e5ee04d8f194d36f6ee67f
CVE-2012-3867: puppet: insufficient validation of agent names in CN of SSL certificate requests
Component: puppet
Severity: Low
Public date: 2012-07-10T00:00:00+00:00

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.


Affected upstream versions: n/a
Fixed upstream versions: 2.6.17
Upstream repository: https://github.com/puppetlabs/puppet
Upstream fix commit: dfedaa5fa841ccf335245a748b347b7c7c236640
CVE-2012-4406: Openstack-Swift: insecure use of python pickle()
Component: Openstack-Swift
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
Public date: 2012-05-30T00:00:00+00:00

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.


Affected upstream versions: n/a
Fixed upstream versions: 1.7.0
Upstream repository: https://github.com/openstack/swift
Upstream fix commit: e1ff51c04554d51616d2845f92ab726cb0e5831a
CVE-2012-4423: libvirt: null function pointer invocation in virNetServerProgramDispatchCall()
Component: libvirt
Severity: Moderate
Public date: 2012-07-24T00:00:00+00:00

The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the RPC dispatch table.

Statement: The versions of libvirt as shipped with Red Hat Enterprise Linux 5 are not affected.

This issue did affect the versions of the libvirt package as shipped with Red Hat Enterprise Linux 6.

Affected upstream versions: n/a
Fixed upstream versions: v0.10.2
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: f8fbeb50d52520a109d71c8566fed2ea600650ec
CVE-2012-4433: gegl: Integer overflow, leading to heap-based buffer overflow by parsing PPM image headers
Component: gegl
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-11-05T00:00:00+00:00

Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image, which triggers a heap-based buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: GEGL_0_3_0
Upstream repository: https://git.gnome.org/browse/gegl
Upstream fix commit: 4757cdf73d3675478d645a3ec8250ba02168a230
CVE-2012-4444: kernel: net: acceptation of overlapping ipv6 fragments
Component: kernel
Severity: Low
Public date: 2009-12-01T00:00:00+00:00

The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.


Affected upstream versions: n/a
Fixed upstream versions: v2.6.36
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 70789d7052239992824628db8133de08dc78e593
CVE-2012-4450: 389-ds-base: Change on SLAPI_MODRDN_NEWSUPERIOR is not evaluated in ACL (ACL rules bypass possible)
Component: 389-ds-base
Severity: Moderate
Public date: 2012-04-16T00:00:00+00:00

389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.


Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/cgit/389/ds.git
Upstream fix commit: 5beb93d42efb807838c09c5fab898876876f8d09
CVE-2012-4453: dracut: Creates initramfs images with world-readable permissions (information disclosure)
Component: dracut
Severity: Moderate
Public date: 2012-09-27T00:00:00+00:00

It was discovered that dracut created initramfs images as world readable. A local user could possibly use this flaw to obtain sensitive information from these files, such as iSCSI authentication passwords, encrypted root file system crypttab passwords, or other information.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/boot/dracut/dracut.git
Upstream fix commit: e1b48995c26c4f06d1a71
CVE-2012-4456: 2012.1.1: fails to validate tokens in Admin API
Component: 2012.1.1
Severity: Moderate
CWE: CWE-304 (Missing Critical Step in Authentication)
Public date: 2012-05-31T00:00:00+00:00

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.


Affected upstream versions: n/a
Fixed upstream versions: 2012.1.2
Upstream repository: https://github.com/openstack/keystone
Upstream fix commit: 24df3adb3f50cbb5ada411bc67aba8a781e6a431
CVE-2012-4457: 2012.1.1: fails to raise Unauthorized user error for disabled tenant
Component: 2012.1.1
Severity: Moderate
Public date: 2012-05-26T00:00:00+00:00

OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.


Affected upstream versions: n/a
Fixed upstream versions: 2012.1.2
Upstream repository: https://github.com/openstack/keystone
Upstream fix commit: 5373601bbdda10f879c08af1698852142b75f8d5
CVE-2012-4461: kernel: kvm: invalid opcode oops on SET_SREGS with OSXSAVE bit set
Component: kernel
Severity: Moderate
Public date: 2012-11-06T00:00:00+00:00

The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.7
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6d1068b3a98519247d8ba4ec85cd40ac136dbdf9
CVE-2012-4462: condor: DoS when removing jobs via jobcontrol.py when job id is in square brackets
Component: condor
Severity: Low
Public date: 2012-09-28T00:00:00+00:00

aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Upstream repository: https://htcondor-git.cs.wisc.edu/condor.git
Upstream fix commit: 8f9b304c4f6c0a98dafa61b2c0e4beb3b70e4c84
CVE-2012-4508: kernel: ext4: AIO vs fallocate stale data exposure
Component: kernel
Severity: Important
Public date: 2012-10-23T00:00:00+00:00

Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.


Affected upstream versions: n/a
Fixed upstream versions: v3.7
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: dee1f973ca341c266229faa5a1a5bb268bed3531
CVE-2012-4512: kdelibs: Heap-based buffer overflow when parsing location of a font face source
Component: kdelibs
Severity: Critical
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2012-10-30T00:00:00+00:00

A heap-based buffer overflow flaw was found in the way the CSS parser of the Document Object Model's (DOM) implementation of KDE libraries performed processing of a location of a particular font face source. A remote attacker with privileges could provide a specially-crafted web page that, when opened in an application linked against KDE libraries, would lead to the application crashing or potential execution of arbitrary code.


Affected upstream versions: 4.7.3
Upstream repository: https://quickgit.kde.org/kdelibs.git
Upstream fix commit: a872c8a969a8bd3706253d6ba24088e4f07f3352
CVE-2012-4513: kdelibs: Heap-based buffer over-read when calculating dimensions of the canvas within the scale loop
Component: kdelibs
Severity: Low
Public date: 2012-10-30T00:00:00+00:00

khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read.


Affected upstream versions: n/a
Upstream repository: https://quickgit.kde.org/kdelibs.git
Upstream fix commit: 1f8b1b034ccf1713a5d123a4c327290f86d17d53
CVE-2012-4516: librdmacm: Tried to connect to port 6125 if ibacm.port was not found
Component: librdmacm
Severity: Low
Public date: 2012-10-08T00:00:00+00:00

librdmacm 1.0.16, when ibacm.port is not specified, connects to port 6125, which allows remote attackers to specify the address resolution information for the application via a malicious ib_acm service.


Affected upstream versions: n/a
Upstream repository: https://git.openfabrics.org/~shefty/librdmacm.git
Upstream fix commit: 4b5c1aa734e0e734fc2ba3cd41d0ddf02170af6d
CVE-2012-4517: ibacm: DoS (ibacm deamon crash) by joining responses for multicast destinations
Component: ibacm
Severity: Low
Public date: 2012-04-04T00:00:00+00:00

ibacm before 1.0.6 does not properly manage reference counts for multicast connections, which allows remote attackers to cause a denial of service (ibacm service crash) via a crafted join response.


Affected upstream versions: n/a
Upstream repository: https://git.openfabrics.org/~shefty/ibacm.git
Upstream fix commit: c7d28b35d64333c262de3ec972c426423dadccf9
CVE-2012-4518: ibacm: ibacm service files created with world writable permissions (DoS)
Component: ibacm
Severity: Low
Public date: 2012-10-09T00:00:00+00:00

ibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite the ib_acm daemon log or ibacm.port file.


Affected upstream versions: n/a
Upstream repository: https://git.openfabrics.org/~shefty/ibacm.git
Upstream fix commit: d204fca2b6298d7799e918141ea8e11e7ad43cec
CVE-2012-4530: kernel: stack disclosure in binfmt_script load_script()
Component: kernel
Severity: Low
Public date: 2012-08-18T00:00:00+00:00

The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.8
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b66c5984017533316fd1951770302649baf1aa33
CVE-2012-4540: icedtea-web: IcedTeaScriptableJavaObject:: invoke off-by-one heap-based buffer overflow
Component: icedtea-web
Severity: Critical
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2012-11-07T00:00:00+00:00

Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea-web-1.2
Upstream fix commit: 596a718be03f
CVE-2012-4542: kernel: block: default SCSI command filter does not accomodate commands overlap across device classes
Component: kernel
Severity: Moderate
Public date: 2013-01-24T00:00:00+00:00

block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.

Statement: This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. Due to the lack of upstream patches and the Moderate impact, we are not planning to address this issue in Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Upstream repository: https://oss.oracle.com/git/redpatch.git
Upstream fix commit: 76a274e17114abf1a77de6b651424648ce9e10c8
CVE-2012-4565: kernel: net: divide by zero in tcp algorithm illinois
Component: kernel
Severity: Moderate
Public date: 2012-10-31T00:00:00+00:00

The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.7
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8f363b77ee4fbf7c3bbcf5ec2c5ca482d396d664
CVE-2012-4573: OpenStack: Glance Authentication bypass for image deletion
Component: OpenStack
Severity: Low
Public date: 2012-11-07T00:00:00+00:00

The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482.


Affected upstream versions: n/a
Fixed upstream versions: 2012.2.1
Upstream repository: https://github.com/openstack/glance
Upstream fix commit: 90bcdc5a89e350a358cf320a03f5afe99795f6f6