huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2019-14439: jackson-databind: Polymorphic typing issue related to logback/JNDI
Component: jackson-databind
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2019-07-30T00:00:00+00:00

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Statement: OpenDaylight provided as part of Red Hat OpenStack does not utilize logback when used in a supported configuration. Therefore, the prerequisites for this vulnerability are not present and OpenDaylight is not affected.

Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.7.9.6
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: ad418eeb974e357f2797aef64aa0e3ffaaa6125b
CVE-2019-14809: golang: malformed hosts in URLs leads to authorization bypass
Component: golang
Severity: Moderate
CWE: CWE-939 (Improper Authorization in Handler for Custom URL Scheme)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2019-08-13T00:00:00+00:00

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.


Affected upstream versions: n/a
Fixed upstream versions: go1.13
Upstream repository: https://github.com/golang/go
Upstream fix commit: 61bb56ad63992a3199acc55b2537c8355ef887b6
CVE-2019-14812: ghostscript: Safer mode bypass by .forceput exposure in setuserparams (701444)
Component: ghostscript
Severity: Important
CWE: CWE-648 (Incorrect Use of Privileged APIs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-08-28T12:00:00+00:00

A flaw was found in the .setuserparams2 procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.


Affected upstream versions: all ghostscript versions 9.x before 9.50
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 885444fcbe10dc42787ecb76686c8ee4dd33bf33
CVE-2019-14813: ghostscript: Safer mode bypass by .forceput exposure in setsystemparams (701443)
Component: ghostscript
Severity: Important
CWE: CWE-648 (Incorrect Use of Privileged APIs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-08-28T12:00:00+00:00

A flaw was found in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.


Affected upstream versions: ghostscript versions 9.x before 9.28
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 885444fcbe10dc42787ecb76686c8ee4dd33bf33
CVE-2019-14814: kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-28T10:00:00+00:00

A flaw was found in the Linux kernel’s implementation of the Marvell wifi driver, which can allow a local user who has CAP_NET_ADMIN or administrative privileges to possibly cause a Denial Of Service (DOS) by corrupting memory and possible code execution.


Affected upstream versions: all versions up to, excluding 5.3
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7caac62ed598a196d6ddf8d9c121e12e082cac3a
CVE-2019-14815: kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-28T10:00:00+00:00

A vulnerability found in the Linux kernel's WMM implementation for Marvell WiFi-based hardware (mwifiex) could lead to a denial of service or allow arbitrary code execution. For this flaw to be executed, the attacker must be both local and privileged. There is no mitigation to this flaw. A patch has been provided to remediate this flaw.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 7caac62ed598a196d6ddf8d9c121e12e082cac3a
CVE-2019-14816: kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver
Component: kernel
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 8 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-28T10:00:00+00:00

A vulnerability was found in the Linux kernel's Marvell WiFi chip driver. Where, while parsing vendor-specific informational attributes, an attacker on the same WiFi physical network segment could cause a system crash, resulting in a denial of service, or potentially execute arbitrary code. This flaw affects the network interface at the most basic level meaning the attacker only needs to affiliate with the same network device as the vulnerable system to create an attack path.


Affected upstream versions: all versions up to, excluding 5.3
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7caac62ed598a196d6ddf8d9c121e12e082cac3a
CVE-2019-14817: ghostscript: Safer mode bypass by .forceput exposure in .pdfexectoken and other procedures (701450)
Component: ghostscript
Severity: Important
CWE: CWE-648 (Incorrect Use of Privileged APIs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-08-28T12:00:00+00:00

A flaw was found in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands.


Affected upstream versions: ghostscript versions prior to 9.28
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: cd1b1cacadac2479e291efe611979bdc1b3bdb19
CVE-2019-14834: dnsmasq: memory leak in the create_helper() function in /src/helper.c
Component: dnsmasq
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2019-10-23T00:00:00+00:00

A flaw was found in the Dnsmasq application where a remote attacker can trigger a memory leak by sending specially crafted DHCP responses to the server. A successful attack is dependent on a specific configuration regarding the domain name set into the dnsmasq.conf file. Over time, the memory leak may cause the process to run out of memory and terminate, causing a denial of service.

Statement: In Red Hat OpenStack Platform, which currently supports Red Hat Enterprise Linux 7.7, the dnsmasq package is pulled directly from the rhel-7-server-rpms channel. Red Hat OpenStack Platform's version is therefore unused, please ensure that the underlying Red Hat Enterprise Linux dnsmasq package is current.

Affected upstream versions: before 2.81
Fixed upstream versions: v2.81
Upstream repository: https://thekelleys.org.uk/gitweb/dnsmasq.git
Upstream fix commit: 69bc94779c2f035a9fffdb5327a54c3aeca73ed5
CVE-2019-14837: keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure
Component: keycloak
Severity: Important
CWE: CWE-547 (Use of Hard-coded, Security-relevant Constants)
CVSS v3: 9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2019-12-02T00:00:00+00:00

A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure.


Affected upstream versions: before 8.0.0
Fixed upstream versions: 8.0.0
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 9a7c1a91a59ab85e7f8889a505be04a71580777f
CVE-2019-14857: mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2019-10-02T00:00:00+00:00

An open redirect flaw was discovered in mod_auth_openidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web site, which would redirect them to another possibly malicious URL.

Statement: It is not possible to reproduce the open redirect vulnerability in the versions of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7, as a missing check makes the process crash, due to a NULL pointer dereference, instead of letting it continue with an invalid URL.

Affected upstream versions: 2.4.0.1
Fixed upstream versions: v2.4.0.1
Upstream repository: https://github.com/zmartzone/mod_auth_openidc
Upstream fix commit: 5c15dfb08106c2451c2c44ce7ace6813c216ba75
CVE-2019-14868: ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection
Component: ksh
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-12-13T00:00:00+00:00

A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.


Affected upstream versions: 20120801
Upstream repository: https://github.com/att/ast
Upstream fix commit: c7de8b641266bac7c77942239ac659edfee9ecd2
CVE-2019-14869: ghostscript: -dSAFER escape in .charkeys (701841)
Component: ghostscript
Severity: Important
CWE: CWE-648 (Incorrect Use of Privileged APIs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-11-14T13:00:00+00:00

A flaw was found in the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands.


Affected upstream versions: all versions of ghostscript 9.x before 9.28
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 485904772c5f
CVE-2019-14980: ImageMagick: use-after-free in magick/blob.c resulting in a denial of service
Component: ImageMagick
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.9 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-04-21T00:00:00+00:00

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-42
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 614a257295bdcdeda347086761062ac7658b6830
CVE-2019-14981: ImageMagick: division by zero in MeanShiftImage in MagickCore/feature.c
Component: ImageMagick
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-04-18T00:00:00+00:00

In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-41
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: b522d2d857d2f75b659936b59b0da9df1682c256
CVE-2019-15030: kernel: powerpc: local user can read vector registers of other users' processes via a Facility Unavailable exception
Component: kernel
Severity: Moderate
CWE: CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2019-09-06T00:00:00+00:00

A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (via a Facility Unavailable exception). An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with values from the different local Linux processes, because of the missing check inside arch/powerpc/kernel/process.c. The highest threat from this vulnerability is confidentiality of data and availability of the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8205d5d98ef7f155de211f5e2eb6ca03d95a5a60
CVE-2019-15031: kernel: powerpc: local user can read vector registers of other users' processes via an interrupt
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2019-09-13T00:00:00+00:00

A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes (during a hardware interrupt). An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupted with values from the different local Linux processes, because of the missing check inside arch/powerpc/kernel/process.c. The highest threat from this vulnerability is confidentiality of data and availability of the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a8318c13e79badb92bc6640704a64cc022a6eb97
CVE-2019-15090: kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-20T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in the Qlogic ISCSI module in the Linux kernel's qedi_dbg_* family of functions in drivers/scsi/qedi/qedi_dbg.c. Here a local attacker with a special user  privilege account (or a root) can cause an out-of-bound  memory access leading to a system crash or a leak of internal kernel information.


Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c09581a52765a85f19fc35340127396d5e3379cc
CVE-2019-15139: ImageMagick: out-of-bounds read in ReadXWDImage in coders/xwd.c
Component: ImageMagick
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-04-20T00:00:00+00:00

The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-41
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: c78993d138bf480ab4652b5a48379d4ff75ba5f7
CVE-2019-15140: ImageMagick: Use after free in ReadMATImage in coders/mat.c
Component: ImageMagick
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2019-04-27T00:00:00+00:00

coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-43
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: f7206618d27c2e69d977abf40e3035a33e5f6be0
CVE-2019-15141: ImageMagick: heap-based buffer overflow in WriteTIFFImage in coders/tiff.c
Component: ImageMagick
Severity: Moderate
CWE: CWE-788 (Access of Memory Location After End of Buffer)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2019-04-28T00:00:00+00:00

WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.10-43
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 3c53413eb544cc567309b4c86485eae43e956112
CVE-2019-15165: libpcap: Resource exhaustion during PHB header length validation
Component: libpcap
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-09-20T00:00:00+00:00

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

Statement: A Low Impact has been given to this flaw even though the CVSSv3 is 7.5, because libpcap library is mainly used as part of debugging tools like wireshark or tcpdump, where an impact to the Availability is not considered security relevant in a reasonable scenario.

Affected upstream versions: n/a
Fixed upstream versions: libpcap-1.9.1
Upstream repository: https://github.com/the-tcpdump-group/libpcap
Upstream fix commit: a5a36d9e82dde7265e38fe1f87b7f11c461c29f6
CVE-2019-15166: tcpdump: Buffer overflow in lmp_print_data_link_subobjs() in print-lmp.c
Component: tcpdump
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

lmp_print_data_link_subobjs() in print-lmp.c in tcpdump before 4.9.3 lacks certain bounds checks.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 0b661e0aa61850234b64394585cf577aac570bf4
CVE-2019-15214: kernel: use-after-free in sound/core/init.c and sound/core/info.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-19T00:00:00+00:00

A vulnerability was found in the Linux kernel’s core sound driver code. A use-after-free in a race condition between disconnection events could allow a local attacker who can trigger disconnection events (remove or add hardware) to crash the system, corrupt memory, or escalate privileges.


Affected upstream versions: n/a
Fixed upstream versions: v5.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 2a3f7221acddfe1caa9ff09b3a8158c39b2fdeac
CVE-2019-15217: kernel: null pointer dereference in drivers/media/usb/zr364xx/zr364xx.c driver
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.6 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-08-19T00:00:00+00:00

A vulnerability was found in the Linux kernel. The Zr364xx USB device driver is susceptible to malicious USB devices. An attacker able to add a specific USB device could cause a crash leading to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v5.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e
CVE-2019-15221: kernel: Null pointer dereference in the sound/usb/line6/pcm.c
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.6 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-08-02T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the LINE6 drivers in the Linux kernel allocated buffers for USB packets. This flaw allows an attacker with physical access to the system to crash the system.

Statement: This issue is rated as having Low impact because of the physical access needed to trigger this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3450121997ce872eb7f1248417225827ea249710
CVE-2019-15223: kernel: Null pointer dereference in the sound/usb/line6/driver.c
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.6 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-08-02T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the Line 6 POD USB driver in the Linux kernel handled disconnection. This flaw allows an attacker with physical access to the system to crash the system.

Statement: This issue is rated as having Low impact because of the physical access needed to trigger this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0b074ab7fc0d575247b9cc9f93bb7e007ca38840
CVE-2019-15239: kernel: local attacker can trigger multiple use-after-free conditions results in privilege escalation
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.4 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2019-08-20T00:00:00+00:00

A flaw was found in the way the Linux kernel's networking subsystem handled the write queue between TCP disconnection and re-connections. A local attacker could use this flaw to trigger multiple use-after-free conditions potentially escalating their privileges on the system.

Statement: This issue affected Red Hat Enterprise Linux 7 starting with kernel version kernel-3.10.0-1053.el7. The first publicly available affected kernel version is kernel-3.10.0-1062.el7 released via https://access.redhat.com/errata/RHSA-2019:2029,  the Red Hat Enterprise Linux 7.7 GA kernel errata release.

Affected upstream versions: n/a
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7f582b248d0a86bae5788c548d7bb5bca6f7691a