huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2011-4132: kernel: jbd/jbd2: invalid value of first log block leads to oops
Component: kernel
Severity: Moderate
Public date: 2011-11-01T00:00:00+00:00

The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."

Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4,
5, 6, and Red Hat Enterprise MRG. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0007.html, https://rhn.redhat.com/errata/RHSA-2012-0350.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html. Red Hat
Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle,
https://access.redhat.com/support/policy/updates/errata/, therefore the fix for
this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v3.2
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 8762202dd0d6e46854f786bdb6fb3780a1625efe
CVE-2011-4318: dovecot: proxy destination host name not checked against SSL certificate name
Component: dovecot
Severity: Low
Public date: 2011-11-17T00:00:00+00:00

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.


Affected upstream versions: n/a
Upstream repository: https://hg.dovecot.org/dovecot-2.0
Upstream fix commit: 5e9eaf63a6b1
CVE-2011-4324: kernel: nfsv4: mknod(2) DoS
Component: kernel
Severity: Moderate
Public date: 2008-12-23T00:00:00+00:00

The encode_share_access function in fs/nfs/nfs4xdr.c in the Linux kernel before 2.6.29 allows local users to cause a denial of service (BUG and system crash) by using the mknod system call with a pathname on an NFSv4 filesystem.

Statement: This issue did not affect the Linux kernels as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they did not have the vulnerable code as introduced in history:1a7bc914. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0007.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: dc0b027dfadfcb8a5504f7d8052754bf8d501ab9
CVE-2011-4325: kernel: nfs: diotest4 from LTP crash client null pointer deref
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2012-01-10T00:00:00+00:00

The NFS implementation in Linux kernel before 2.6.31-rc6 calls certain functions without properly initializing certain data, which allows local users to cause a denial of service (NULL pointer dereference and O_DIRECT oops), as demonstrated using diotest4 from LTP.

Statement: This issue did not affect the version of the Linux kernel as shipped with Red
Hat Enterprise Linux 4, 6 and Red Hat Enterprise MRG. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0007.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.31
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 1ae88b2e4
CVE-2011-4326: kernel: wrong headroom check in udp6_ufo_fragment()
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2011-03-03T00:00:00+00:00

The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they did not provide support for UDP Fragmentation Offload (UFO) functionality. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a9cf73ea7ff78f52662c8658d93c226effbbedde
CVE-2011-4330: kernel: hfs: add sanity check for file name length
Component: kernel
Severity: Moderate
Public date: 2011-11-09T00:00:00+00:00

Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with a crafted len field.

Statement: This issue did not affect the Linux kernels as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they did not include support for the Hierarchical File System (HFS) file system. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0007.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.2
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: bc5b8a9003132ae44559edd63a1623
CVE-2011-4347: kernel: kvm: device assignment DoS
Component: kernel
Severity: Moderate
Public date: 2011-11-20T00:00:00+00:00

The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG as they did not provide support for the KVM subsystem. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0350.html. A future kvm update in Red Hat Enterprise 5 may address this flaw.

Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c4e7f9022e506c6635a5037713c37118e23193e4
CVE-2011-4348: kernel: incomplete fix for CVE-2011-2482
Component: kernel
Severity: Important
CWE: CWE-764 (Multiple Locks of a Critical Resource)
Public date: 2012-01-10T00:00:00+00:00

Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets.  NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482.

Statement: This issue did not affect the version of the Linux kernel as shipped with Red Hat Enterprise Linux 4, 6 and Red Hat Enterprise MRG as they were not vulnerable to CVE-2011-2482. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0007.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.29
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ae53b5bd77719fed58086c5be60ce4f22bffe1c6
CVE-2011-4594: kernel: send(m)msg: user pointer dereferences
Component: kernel
Severity: Moderate
Public date: 2011-08-25T00:00:00+00:00

The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4, 5 and Red Hat Enterprise MRG as they did not provide support for the sendmmsg syscall. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0350.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.1
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
CVE-2011-4600: libvirt: unintended firewall port exposure after restarting libvirtd when defining a bridged forward-mode network
Component: libvirt
Severity: Low
Public date: 2011-12-09T00:00:00+00:00

The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query.

Statement: This issue affect Red Hat Enterprise Linux 6 and has been addressed via 
https://rhn.redhat.com/errata/RHBA-2012-0013.html. Red Hat Enterprise Linux 5 is 
not affected. The Red Hat Security Response Team has rated this issue as having 
low security impact. For additional information, refer to the Issue Severity 
Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v0.9.9
Upstream repository: https://libvirt.org/git/libvirt.git
Upstream fix commit: ae1232b298323dd7bef909426e2ebafa6bca9157
CVE-2011-4611: kernel: perf, powerpc: Handle events that raise an exception without overflowing
Component: kernel
Severity: Moderate
Public date: 2011-03-16T00:00:00+00:00

Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.

Statement: This issue did not affect the Linux kernels as shipped with Red Hat Enterprise Linux 4 and 5 as they did not have support for Performance event. It did not affect Red Hat Enterprise MRG as it did not provide support for PowerPC. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0350.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.39
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 0837e3242c73566fc1c0196b4ec61779c25ffc93
CVE-2011-4621: kernel: tight loop and no preemption can cause system stall
Component: kernel
Severity: Moderate
Public date: 2010-11-21T00:00:00+00:00

The Linux kernel before 2.6.37 does not properly implement a certain clock-update optimization, which allows local users to cause a denial of service (system hang) via an application that executes code in a loop.

Statement: This issue does not affect Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.37
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f26f9aff6aaf67e9a430d16c266f91b13a5bff64
CVE-2011-4623: rsyslog: DoS due integer signedness error while extending rsyslog counted string buffer
Component: rsyslog
Severity: Moderate
Public date: 2011-02-09T00:00:00+00:00

Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow.


Affected upstream versions: n/a
Upstream repository: https://git.adiscon.com/rsyslog.git
Upstream fix commit: 6bad782f154b7f838c7371bf99c13f6dc4ec4101
CVE-2011-4862: krb5: telnet client and server encrypt_keyid heap-based buffer overflow
Component: krb5
Severity: Critical
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
Public date: 2011-12-25T00:00:00+00:00

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

Statement: A buffer overflow flaw was found in the MIT krb5 telnet daemon (telnetd) as shipped with all supported versions of Red Hat Enterprise Linux. A remote attacker who can access the telnet port of a target machine could use this flaw to execute arbitrary code as root.

While we are aware of public exploits for this issue that include targets for Red Hat Enterprise Linux 3, we are not aware of any yet which would be successful in gaining arbitrary root code execution in Red Hat Enterprise Linux 4, 5, or 6.  However it is plausible that one could be created to do so.

Note that the krb5 telnet daemon is not enabled by default in any version of Red Hat Enterprise Linux. In addition, the default firewall rules block remote access to the telnet port. This flaw does not affect the telnet daemon distributed in the telnet-server package.

For users who have enabled the krb5 telnet daemon and have it accessible remotely, they should disable it or apply the updates we have released.

Since same encryption code is shared between the MIT krb5 telnet daemon and the telnet client, this issue affects the telnet client as well. The updates we have released fixes the issue for both, the telnet daemon and the telnet client.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/inetutils.git
Upstream fix commit: 665f1e73cdd9b38e2d2e11b8db9958a315935592
CVE-2011-4922: Cipher API information disclosure in pidgin
Component: Cipher API information disclosure in pidgin
Severity: Low
Public date: 2011-02-10T00:00:00+00:00

cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact. A future update may address this issue in Red Hat Enterprise Linux 4 or 5 (it has been addressed in Red Hat Enterprise Linux 6). For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 8c850977cb42
CVE-2011-4930: Condor: Multiple format string flaws
Component: Condor
Severity: Moderate
Public date: 2012-02-06T00:00:00+00:00

Multiple format string vulnerabilities in Condor 7.2.0 through 7.6.4, and possibly certain 7.7.x versions, as used in Red Hat MRG Grid and possibly other products, allow local users to cause a denial of service (condor_schedd daemon and failure to launch jobs) and possibly execute arbitrary code via format string specifiers in (1) the reason for a hold for a job that uses an XML user log, (2) the filename of a file to be transferred, and possibly other unspecified vectors.


Affected upstream versions: n/a
Upstream repository: https://htcondor-git.cs.wisc.edu/condor.git
Upstream fix commit: 5e5571d1a431eb3c61977b6dd6ec90186ef79867
CVE-2011-4966: freeradius: does not respect expired passwords when using the unix module
Component: freeradius
Severity: Low
Public date: 2011-11-14T00:00:00+00:00

modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.


Affected upstream versions: n/a
Fixed upstream versions: branch_4_0_0
Upstream repository: https://github.com/alandekok/freeradius-server
Upstream fix commit: 1b1ec5ce75e224bd1755650c18ccdaa6dc53e605
CVE-2011-5321: Kernel: tty: driver reference leakage in tty_open
Component: Kernel
Severity: Moderate
Public date: 2011-10-12T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the Linux kernel's virtual console implementation handled reference counting when accessing pseudo-terminal device files (/dev/pts/*). A local, unprivileged attacker could use this flaw to crash the system.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 7 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat
Enterprise Linux 6. Future kernel updates for Red Hat Enterprise Linux 6
may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.2
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c290f8358acaeffd8e0c551ddcc24d1206143376
CVE-2012-0028: kernel: futex: clear robust_list on execve
Component: kernel
Severity: Important
Public date: 2008-11-15T00:00:00+00:00

The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not have support for robust futexes. It did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they have the backported fixes. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0107.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.28
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8141c7f3e7aee618312fa1c15109e1219de784a7
CVE-2012-0037: raptor: XML External Entity (XXE) attack via RDF files
Component: raptor
Severity: Important
Public date: 2012-03-22T00:00:00+00:00

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.


Affected upstream versions: n/a
Fixed upstream versions: raptor2_2_0_7
Upstream repository: https://github.com/dajobe/raptor
Upstream fix commit: a676f235309a59d4aa78eeffd2574ae5d341fcb0
CVE-2012-0038: kernel: xfs heap overflow
Component: kernel
Severity: Moderate
Public date: 2011-12-16T00:00:00+00:00

Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not have support for the XFS file system. It did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 5 as it did not backport the upstream commit ef14f0c1 that introduced the vulnerability. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0350.html, and https://rhn.redhat.com/errata/RHSA-2012-0333.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: fa8b18edd752a8b4e9d1ee2cd615b82c93cf8bba
CVE-2012-0044: kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl()
Component: kernel
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2011-11-23T00:00:00+00:00

Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport commit 884840aa that introduced this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a5cd335165e31db9dbab636fd29895d41da55dd2
CVE-2012-0045: kernel: kvm: syscall instruction induced guest panic
Component: kernel
Severity: Moderate
Public date: 2011-12-29T00:00:00+00:00

The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG as they did not provide support for the KVM subsystem. This issue did not affect the versions of kvm as shipped with Red Hat Enterprise Linux 5 as they did not include support for syscall instruction emulation. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0350.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.3
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c2226fc9e87ba3da060e47333657cd6616652b84
CVE-2012-0056: kernel: proc: /proc/<pid>/mem mem_write insufficient permission checking
Component: kernel
Severity: Important
CWE: CWE-863 (Incorrect Authorization)
Public date: 2012-01-18T00:00:00+00:00

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as it did not backport the upstream commit 198214a7ee. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0052.html and  https://rhn.redhat.com/errata/RHSA-2012-0061.html. For more information, please read https://access.redhat.com/kb/docs/DOC-69129.

Affected upstream versions: n/a
Fixed upstream versions: v3.3
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e268337dfe26dfc7efd422a804dbb27977a3cccc
CVE-2012-0060: rpm: insufficient validation of region tags
Component: rpm
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
Public date: 2012-04-03T00:00:00+00:00

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.


Affected upstream versions: n/a
Upstream repository: https://rpm.org/rpm.git
Upstream fix commit: e4eab2bc6d07cfd33f740071de7ddbb2fe2f4190
CVE-2012-0061: rpm: improper validation of header contents total size in headerLoad()
Component: rpm
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-04-03T00:00:00+00:00

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.


Affected upstream versions: n/a
Upstream repository: https://rpm.org/rpm.git
Upstream fix commit: 472e569562d4c90d7a298080e0052856aa7fa86b