huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2017-15649: kernel: Use-after-free in the af_packet.c
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-09-20T00:00:00+00:00

It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6, allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free bug.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as a code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.14
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 008ba2a13f2d04c947adc536d19debb8fe66f110
CVE-2017-15804: glibc: Buffer overflow during unescaping of user names with the ~ operator
Component: glibc
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-10-21T00:00:00+00:00

The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.27
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: a159b53fa059947cc2548e3b0d5bdcf7b9630ba8
CVE-2017-15906: openssh: Improper write operations in readonly mode allow for zero-length file creation
Component: openssh
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-10-03T00:00:00+00:00

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.


Affected upstream versions: n/a
Upstream repository: https://github.com/openbsd/src
Upstream fix commit: a6981567e8e215acc1ef690c8dbb30f2d9b00a19
CVE-2017-16642: php: Out-of-bound read in timelib_meridian()
Component: php
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2017-11-07T00:00:00+00:00

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this is a different issue than CVE-2017-11145.


Affected upstream versions: n/a
Fixed upstream versions: 2017.05
Upstream repository: https://github.com/derickr/timelib
Upstream fix commit: aa9156006e88565e1f1a5f7cc088b18322d57536
CVE-2017-16820: collectd: double free in csnmp_read_table function in snmp.c
Component: collectd
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2017-11-14T00:00:00+00:00

A double-free vulnerability was found in the csnmp_read_table function in the SNMP plugin of collectd. A network-based attacker could exploit this by sending malformed data, causing collectd to crash or possibly other impact.


Affected upstream versions: n/a
Fixed upstream versions: collectd-5.6.3
Upstream repository: https://github.com/collectd/collectd
Upstream fix commit: d16c24542b2f96a194d43a73c2e5778822b9cb47
CVE-2017-16939: Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation
Component: Kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Public date: 2017-11-24T00:00:00+00:00

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could  abuse this flaw to potentially escalate their privileges on a system.

Statement: This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of the kernel package as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 1137b5e2529a8f5ca8ee709288ecba3e68044df2
CVE-2017-16994: kernel: mm/pagewalk.c: walk_hugetlb_range function mishandles holes in hugetlb ranges causing information leak
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2017-11-15T00:00:00+00:00

The walk_hugetlb_range() function in 'mm/pagewalk.c' file in the Linux kernel from v4.0-rc1 through v4.15-rc1 mishandles holes in hugetlb ranges. This allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2, as a code with the flaw is not present in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7 for ARM and Red Hat Enterprise Linux 7 for Power LE in the "kernel-alt" packages.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 373c4557d2aa362702c4c2d41288fb1e54990b7c
CVE-2017-17712: kernel: Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-12-10T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 as they do not contain the upstream commit (c008ba5bdc9f) that allows this issue to be exploited.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 for ARM and Red Hat Enterprise Linux for Power LE.

Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483
CVE-2017-17805: kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial-of-service
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-11-29T00:00:00+00:00

The Salsa20 encryption algorithm in the Linux kernel, before 4.14.8, does not correctly handle zero-length inputs. This allows a local attacker the ability to use the AF_ALG-based skcipher interface to cause a denial of service (uninitialized-memory free and kernel crash) or have an unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 are vulnerable.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64, and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ecaaab5649781c5a0effdaf298a925063020500e
CVE-2017-17806: kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed allowing local attackers to cause denial-of-service
Component: kernel
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-11-29T00:00:00+00:00

The HMAC implementation (crypto/hmac.c) in the Linux kernel, before 4.14.8, does not validate that the underlying cryptographic hash algorithm is unkeyed. This allows a local attacker, able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, its real-time kernel and Red Hat Enterprise MRG 2.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1
CVE-2017-17807: kernel: Missing permissions check for request_key() destination allows local attackers to add keys to keyring without Write permission
Component: kernel
Severity: Moderate
CWE: CWE-862 (Missing Authorization)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2017-12-08T00:00:00+00:00

The KEYS subsystem in the Linux kernel omitted an access-control check when writing a key to the current task's default keyring, allowing a local user to bypass security checks to the keyring. This compromises the validity of the keyring for those who rely on it.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This is not currently planned to be addressed in future updates of the product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 4dca6ea1d9432052afb06baf2e3ae78188a4410b
CVE-2017-18017: kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-01-03T00:00:00+00:00

The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This is not currently planned to be addressed in future updates of the product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2638fd0f92d4397884fd991d8f4925cb3f081901
CVE-2017-18075: kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service
Component: kernel
Severity: Moderate
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-12-20T00:00:00+00:00

crypto/pcrypt.c in the Linux kernel, before 4.14.13, mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, its real-time kernel and Red Hat Enterprise MRG 2, as the code with the flaw is not enabled and is not built in the products listed.

This issue affects the Linux kernel packages as shipped with  Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d76c68109f37cb85b243a1cf0f40313afd2bae68
CVE-2017-18077: nodejs-brace-expansion: Regular expression denial of service
Component: nodejs-brace-expansion
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-03-02T00:00:00+00:00

index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

Statement: Red Hat Quay include brace-explansion as a build time dependency. It's not used at runtime and hence has a reduce impact of low.

Affected upstream versions: n/a
Fixed upstream versions: v1.1.7
Upstream repository: https://github.com/juliangruber/brace-expansion
Upstream fix commit: b13381281cead487cbdbfd6a69fb097ea5e456c3
CVE-2017-18190: cups: DNS rebinding attacks via incorrect whitelist
Component: cups
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 5.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L)
Public date: 2018-02-16T00:00:00+00:00

A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).


Affected upstream versions: n/a
Fixed upstream versions: v2.2.2
Upstream repository: https://github.com/apple/cups
Upstream fix commit: afa80cb2b457bf8d64f775bed307588610476c41
CVE-2017-18201: libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c
Component: libcdio
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 2.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-02-27T00:00:00+00:00

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/libcdio.git
Upstream fix commit: f6f9c48fb40b8a1e8218799724b0b61a7161eb1d
CVE-2017-18202: kernel: Infoleak/use-after-free in __oom_reap_task_mm function in mm/oom_kill.c
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2018-02-27T00:00:00+00:00

The __oom_reap_task_mm function in mm/oom_kill.c in the Linux kernel, before 4.14.4, mishandles gather operations. This allows attackers to cause a denial of service (TLB entry leak or use-after-free) or possibly have unspecified other impact by triggering a copy_to_user call within a certain time window.


Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 687cb0884a714ff484d038e9190edc874edcf146
CVE-2017-18203: kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-11-01T00:00:00+00:00

The Linux kernel, before version 4.14.3, is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, as the code with the flaw is not present in this product.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b9a41d21dceadf8104812626ef85dc56ee8a60ed
CVE-2017-18208: kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of service
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-11-30T00:00:00+00:00

The madvise_willneed function in the Linux kernel allows local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.


Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6ea8d958a2c95a1d514015d4e29ba21a8c0a1a91
CVE-2017-18232: kernel: Mishandling mutex within libsas allowing local Denial of Service
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 3.1 (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2017-12-08T00:00:00+00:00

The Serial Attached SCSI (SAS) implementation in the Linux kernel mishandles a mutex within libsas. This allows local users to cause a denial of service (deadlock) by triggering certain error-handling code.


Affected upstream versions: n/a
Fixed upstream versions: v4.16
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0558f33c06bb910e2879e355192227a8e8f0219d
CVE-2017-18233: exempi: Infinite Loop in Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp
Component: exempi
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-08-11T00:00:00+00:00

An issue was discovered in Exempi before 2.4.4. Integer overflow in the Chunk class in XMPFiles/source/FormatSupport/RIFF.cpp allows remote attackers to cause a denial of service (infinite loop) via crafted XMP data in a .avi file.

Statement: This issue did not affect the versions of exempi as shipped with Red Hat Enterprise Linux 6 as they did not include the vulnerable code.

Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/exempi
Upstream fix commit: 65a8492832b7335ffabd01f5f64d89dec757c260
CVE-2017-18234: exempi: Use after free via a PDF file containing JPEG data
Component: exempi
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-03-25T00:00:00+00:00

An issue was discovered in Exempi before 2.4.3. It allows remote attackers to cause a denial of service (invalid memcpy with resultant use-after-free) or possibly have unspecified other impact via a .pdf file containing JPEG data, related to XMPFiles/source/FormatSupport/ReconcileTIFF.cpp, XMPFiles/source/FormatSupport/TIFF_MemoryReader.cpp, and XMPFiles/source/FormatSupport/TIFF_Support.hpp.

Statement: This issue affects the versions of exempi as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/exempi
Upstream fix commit: c26d5beb60a5a85f76259f50ed3e08c8169b0a0c
CVE-2017-18236: exempi: Infinite loop in ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp
Component: exempi
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2017-08-30T00:00:00+00:00

An issue was discovered in Exempi before 2.4.4. The ASF_Support::ReadHeaderObject function in XMPFiles/source/FormatSupport/ASF_Support.cpp allows remote attackers to cause a denial of service (infinite loop) via a crafted .asf file.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/exempi
Upstream fix commit: fe59605d3520bf2ca4e0a963d194f10e9fee5806
CVE-2017-18238: exempi: Infinite loop in TradQT_Manager::ParseCachedBoxes function in XMPFiles/source/FormatSupport/QuickTime_Support.cpp
Component: exempi
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-03-20T00:00:00+00:00

An infinite loop has been discovered in Exempi in the way it handles Extensible Metadata Platform (XMP) data in QuickTime files. An attacker could cause a denial of service via a crafted file.

Statement: This issue did not affect the versions of Exempi as shipped with Red Hat Enterprise Linux 6 as they did not include the vulnerable code.

Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/exempi
Upstream fix commit: 886cd1d2314755adb1f4cdb99c16ff00830f0331