huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2014-9671: freetype: integer overflow in pcf_get_properties() leading to NULL pointer dereference
Component: freetype
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-11-24T00:00:00+00:00

Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git
Upstream fix commit: 0e2f5d518c60e2978f26400d110eff178fa7e3c3
CVE-2014-9673: freetype: integer signedness error in Mac_Read_POST_Resource() leading to heap-based buffer overflow
Component: freetype
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2014-11-24T00:00:00+00:00

An integer signedness flaw, leading to a heap-based buffer overflow, was found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git
Upstream fix commit: 35252ae9aa1dd9343e9f4884e9ddb1fee10ef415
CVE-2014-9674: freetype: multiple integer overflows Mac_Read_POST_Resource() leading to heap-based buffer overflows
Component: freetype
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2015-02-08T00:00:00+00:00

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way FreeType handled Mac fonts. If a specially crafted font file was loaded by an application linked against FreeType, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git
Upstream fix commit: 240c94a185cd8dae7d03059abec8a5662c35ecd3
CVE-2014-9675: freetype: information leak in _bdf_add_property()
Component: freetype
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Public date: 2015-02-08T00:00:00+00:00

bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/freetype/freetype2.git
Upstream fix commit: 2c4832d30939b45c05757f0a05128ce64c4cacc7
CVE-2014-9683: kernel: buffer overflow in eCryptfs
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2015-02-17T00:00:00+00:00

A buffer overflow flaw was found in the way the Linux kernel's eCryptfs implementation decoded encrypted file names. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

Statement: This issue did not affect versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 7; and kernel-rt packages as shipped with Red Hat Enterprise MRG 2 and Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: v3.19
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 942080643bce061c3dd9d5718d3b745dcb39a8bc
CVE-2014-9709: gd: buffer read overflow in gd_gif_in.c
Component: gd
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2014-12-13T00:00:00+00:00

A buffer over-read flaw was found in the GD library. A specially crafted GIF file could cause an application using the gdImageCreateFromGif() function to crash.


Affected upstream versions: n/a
Upstream repository: https://bitbucket.org/libgd/gd-libgd
Upstream fix commit: 47eb44b2e90ca88a08dca9f9a1aa9041e9587f43
CVE-2014-9715: kernel: netfilter connection tracking extensions denial of service
Component: kernel
Severity: Moderate
CWE: CWE-841 (Improper Enforcement of Behavioral Workflow)
Public date: 2015-04-08T00:00:00+00:00

An integer overflow flaw was found in the way the Linux kernel's netfilter connection tracking implementation loaded extensions. An attacker on a local network could potentially send a sequence of specially crafted packets that would initiate the loading of a large number of extensions, causing the targeted system in that network to crash.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6. This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2.

For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v3.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 223b02d923ecd7c84cf9780bb3686f455d279279
CVE-2014-9767: php: ZipArchive:: extractTo allows for directory traversal when creating directories
Component: php
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
Public date: 2015-08-25T00:00:00+00:00

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.


Affected upstream versions: n/a
Fixed upstream versions: HHVM-3.13.0
Upstream repository: https://github.com/facebook/hhvm
Upstream fix commit: 65c95a01541dd2fbc9c978ac53bed235b5376686
CVE-2014-9938: git: git-prompt.sh does not sanitize branch names in $PS1
Component: git
Severity: Moderate
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2014-04-22T00:00:00+00:00

It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell to include repository information in the prompt.


Affected upstream versions: n/a
Fixed upstream versions: v1.9.3
Upstream repository: https://github.com/git/git
Upstream fix commit: 8976500cbbb13270398d3b3e07a17b8cc7bff43f
CVE-2015-0204: openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)
Component: openssl
Severity: Moderate
CWE: CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2015-01-06T00:00:00+00:00

It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method.

Statement: This issue affects versions of openssl as shipped with Red Hat Enterprise Linux 5, 6 and 7. Errata have been released to correct this issue.

This issue affects the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact and does not plan to address this flaw for the openssl098e component in any future security updates.

This issue affects the version of openssl097a as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: ce325c60c74b0fa784f5872404b722e120e5cab0
CVE-2015-0205: openssl: DH client certificates accepted without verification
Component: openssl
Severity: Low
Public date: 2015-01-08T00:00:00+00:00

It was found that an OpenSSL server would, under certain conditions, accept Diffie-Hellman client certificates without the use of a private key. An attacker could use a user's client certificate to authenticate as that user, without needing the private key.

Statement: This issue does not affect the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 1421e0c584ae9120ca1b88098f13d6d2e90b83a3
CVE-2015-0206: openssl: DTLS memory leak in dtls1_buffer_record
Component: openssl
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
Public date: 2015-01-08T00:00:00+00:00

A memory leak flaw was found in the way the dtls1_buffer_record() function of OpenSSL parsed certain DTLS messages. A remote attacker could send multiple specially crafted DTLS messages to exhaust all available memory of a DTLS server.

Statement: This issue does not affect the version of openssl and openssl097a as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of openssl098e as shipped with Red Hat Enterprise Linux 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 103b171d8fc282ef435f8de9afbf7782e312961f
CVE-2015-0209: openssl: use-after-free on invalid EC private key import
Component: openssl
Severity: Low
CWE: CWE-416 (Use After Free)
Public date: 2015-02-09T00:00:00+00:00

A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_0_9_8zf
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 1b4a8df38fc9ab3c089ca5765075ee53ec5bd66a
CVE-2015-0228: httpd: Possible mod_lua crash due to websocket bug
Component: httpd
Severity: Low
Public date: 2015-03-10T00:00:00+00:00

A denial of service flaw was found in the way the mod_lua httpd module processed certain WebSocket Ping requests. A remote attacker could send a specially crafted WebSocket Ping packet that would cause the httpd child process to crash.

Statement: This issue did not affect the version of httpd package as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Affected upstream versions: n/a
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: 643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef
CVE-2015-0231: php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142)
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2015-01-01T00:00:00+00:00

A use-after-free flaw was found in the way PHP's unserialize() function processed data. If a remote attacker was able to pass crafted input to PHP's unserialize() function, they could cause the PHP interpreter to crash or, possibly, execute arbitrary code.

Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 and 6 or the versions of php53 as shipped with Red Hat Enterprise Linux 5 as the original flaw (CVE-2014-8142) did not affect these versions.

Affected upstream versions: n/a
Fixed upstream versions: php-5.4.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: b585a3aed7880a5fa5c18e2b838fc96f40e075bd
CVE-2015-0232: php: Free called on unitialized pointer in exif.c
Component: php
Severity: Moderate
CWE: CWE-822 (Untrusted Pointer Dereference)
Public date: 2015-01-01T00:00:00+00:00

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.


Affected upstream versions: n/a
Fixed upstream versions: php-5.4.37
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 2fc178cf448d8e1b95d1314e47eeef610729e0df
CVE-2015-0239: kernel: kvm: insufficient sysenter emulation when invoked from 16-bit code
Component: kernel
Severity: Low
CWE: CWE-391 (Unchecked Error Condition)
Public date: 2015-01-27T00:00:00+00:00

It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS did not initialize the SYSENTER model-specific registers (MSRs). Note: Certified guest operating systems for Red Hat Enterprise Linux with KVM do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on a KVM hypervisor.

Statement: This issue did not affect the kvm packages as shipped with Red Hat Enterprise Linux 5 as they lack support for sysenter instruction emulation.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. A future update may address this issue.

Please note that the Red Hat Enterprise Linux with KVM certified guest operating
systems do initialize the SYSENTER MSRs and are thus not vulnerable to
this issue when running on KVM hypervisor.

Affected upstream versions: n/a
Fixed upstream versions: v3.19
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f3747379accba8e95d70cec0eae0582c8c182050
CVE-2015-0253: httpd: NULL pointer dereference crash with ErrorDocument 400 pointing to a local URL-path
Component: httpd
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-07-15T00:00:00+00:00

A NULL pointer dereference flaw was found in the way httpd generated certain error responses. A remote attacker could possibly use this flaw to crash the httpd child process using a request that triggers a certain HTTP error.

Statement: This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 4, 5, 6, and 7; JBoss Enterprise Web Server 1 and 2; JBoss Web Server 3; and JBoss Enterprise Application Platform 6.

Affected upstream versions: n/a
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: 6a974059190b8a0c7e499f4ab12fe108127099cb
CVE-2015-0263: Camel: XXE in via SAXSource expansion
Component: Camel
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
Public date: 2015-03-17T00:00:00+00:00

It was found that Apache Camel's XML converter performed XML External Entity (XXE) expansion. A remote attacker able to submit an SAXSource containing an XXE declaration could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.


Affected upstream versions: n/a
Upstream repository: https://git-wip-us.apache.org/repos/camel.git
Upstream fix commit: 7d19340bcdb42f7aae584d9c5003ac4f7ddaee36
CVE-2015-0264: Camel: XXE via XPath expression evaluation
Component: Camel
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
Public date: 2015-03-17T00:00:00+00:00

It was found that Apache Camel performed XML External Entity (XXE) expansion when evaluating invalid XML Strings or invalid XML GenericFile objects. A remote attacker able to submit a crafted XML message could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.


Affected upstream versions: n/a
Upstream repository: https://git-wip-us.apache.org/repos/camel.git
Upstream fix commit: 1df559649a96a1ca0368373387e542f46e4820da
CVE-2015-0272: NetworkManager: remote DoS using IPv6 RA with bogus MTU
Component: NetworkManager
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
Public date: 2015-02-23T00:00:00+00:00

It was discovered that NetworkManager would set device MTUs based on MTU values received in IPv6 RAs (Router Advertisements), without sanity checking the MTU value first. A remote attacker could exploit this flaw to create a denial of service attack, by sending a specially crafted IPv6 RA packet to disturb IPv6 communication.


Affected upstream versions: n/a
Fixed upstream versions: 1.2.0
Upstream repository: https://cgit.freedesktop.org/NetworkManager/NetworkManager
Upstream fix commit: d5fc88e573fa58b93034b04d35a2454f5d28cad9
CVE-2015-0273: php: use after free vulnerability in unserialize() with DateTimeZone
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2015-02-19T00:00:00+00:00

A use-after-free flaw was found in the unserialize() function of PHP's DateTimeZone implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory.

Statement: This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable code.

Affected upstream versions: n/a
Fixed upstream versions: php-5.6.6
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 71335e6ebabc1b12c057d8017fd811892ecdfd24
CVE-2015-0274: kernel: xfs: replacing remote attributes memory corruption
Component: kernel
Severity: Important
Public date: 2015-03-05T00:00:00+00:00

A flaw was found in the way the Linux kernel's XFS file system handled replacing of remote attributes under certain conditions. A local user with access to XFS file system mount could potentially use this flaw to escalate their privileges on the system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise 5 and 6. This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8275cdd0e7ac550dcce2b3ef6d2fb3b808c1ae59
CVE-2015-0275: kernel: fs: ext4: fallocate zero range page size > block size BUG()
Component: kernel
Severity: Moderate
Public date: 2015-02-18T00:00:00+00:00

A flaw was found in the way the Linux kernel's ext4 file system handled the "page size > block size" condition when the fallocate zero range functionality was used. A local attacker could use this flaw to crash the system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6. This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future updates in the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.1
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0f2af21aae11972fa924374ddcf52e88347cf5a8
CVE-2015-0283: slapi-nis: infinite loop in getgrnam_r() and getgrgid_r()
Component: slapi-nis
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-03-26T00:00:00+00:00

It was discovered that the slapi-nis Directory Server plug-in did not correctly perform memory reallocation when handling user account information. A request for information about a group with many members, or a request for a user that belongs to a large number of groups, would cause a Directory Server to enter an infinite loop and consume an excessive amount of CPU time.


Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/cgit/slapi-nis.git
Upstream fix commit: 6573f91c95f7a353ad3bdf2fe95b0c15932aa097
CVE-2015-0284: Satellite: stored XSS in user details fields (incomplete fix for CVE-2014-7811)
Component: Satellite
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Public date: 2015-03-03T00:00:00+00:00

A cross-site scripting (XSS) flaw was found in how XML data was handled in Red Hat Satellite. A user able to use the XMLRPC API could exploit this flaw to perform XSS attacks against other Satellite users.


Affected upstream versions: n/a
Fixed upstream versions: gyp-0.1-0.6.1010svn.3
Upstream repository: https://github.com/spacewalkproject/spacewalk
Upstream fix commit: dd418384171473c3e31386a1b4792f8c555dc744
CVE-2015-0286: openssl: invalid pointer use in ASN1_TYPE_cmp()
Component: openssl
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2015-03-19T00:00:00+00:00

An invalid pointer use flaw was found in OpenSSL's ASN1_TYPE_cmp() function. A remote attacker could crash a TLS/SSL client or server using OpenSSL via a specially crafted X.509 certificate when the attacker-supplied certificate was verified by the application.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2a
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: c3c7fb07dc975dc3c9de0eddb7d8fd79fc9c67c1
CVE-2015-0287: openssl: ASN.1 structure reuse memory corruption
Component: openssl
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2015-03-19T00:00:00+00:00

An out-of-bounds write flaw was found in the way OpenSSL reused certain ASN.1 structures. A remote attacker could possibly use a specially crafted ASN.1 structure that, when parsed by an application, would cause that application to crash.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2a
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: b717b083073b6cacc0a5e2397b661678aff7ae7f
CVE-2015-0288: openssl: X509_to_X509_REQ NULL pointer dereference
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-03-19T00:00:00+00:00

A NULL pointer dereference flaw was found in OpenSSL's X.509 certificate handling implementation. A specially crafted X.509 certificate could cause an application using OpenSSL to crash if the application attempted to convert the certificate to a certificate request.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_1_0
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 28a00bcd8e318da18031b2ac8778c64147cd54f9
CVE-2015-0289: openssl: PKCS7 NULL pointer dereference
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2015-03-19T00:00:00+00:00

A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2a
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: c0334c2c92dd1bc3ad8138ba6e74006c3631b0f9