huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-20976: kernel: use-after-free in fs/xfs/xfs_super.c
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-05-15T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of the XFS filesystem. A key data structure (sb->s_fs_info)  may not be de-allocated when the system is under memory pressure. This same data structure is then used at a later time during filesystem operations. This could allow a local attacker who is able to groom memory to place an attacker-controlled data structure in this location and create a use-after-free situation which can result in memory corruption or privilege escalation.

Statement: Red Hat Enterprise Linux 7.6.z had fixed this flaw mid release without it being recognised as a CVE.  Prior releases of Red Hat Enterprise Linux EUS/AUS will still require the fix to be secure.  Trackers have been made and fixes will be available as part of the standard release cycle.

Affected upstream versions: n/a
Fixed upstream versions: v4.18
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c9fbd7bbc23dbdd73364be4d045e5d3612cf6e82
CVE-2018-21009: poppler: integer overflow in Parser::makeStream in Parser.cc
Component: poppler
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.9 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2019-09-05T00:00:00+00:00

Poppler before 0.66.0 has an integer overflow in Parser::makeStream in Parser.cc.


Affected upstream versions: n/a
Fixed upstream versions: poppler-0.66.0
Upstream repository: https://gitlab.freedesktop.org/poppler/poppler
Upstream fix commit: 0868c499a9f5f37f8df5c9fef03c37496b40fc8a
CVE-2018-25032: zlib: A flaw found in zlib when compressing (not decompressing) certain inputs
Component: zlib
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-04-20T00:00:00+00:00

An out-of-bounds access flaw was found in zlib, which allows memory corruption when deflating (ex: when compressing) if the input has many distant matches. For some rare inputs with a large number of distant matches (crafted payloads), the buffer into which the compressed or deflated data is written can overwrite the distance symbol table which it overlays. This issue results in corrupted output due to invalid distances, which leads to out-of-bound access, corrupting the memory and potentially crashing the application.

Statement: This bug was introduced in zlib v1.2.2.2 through zlib v1.2.11, with the addition of the Z_FIXED option, which forces the use of fixed Huffman codes, rather than dynamic Huffman codes, allowing for a simpler decoder for special applications.

This bug is difficult to trigger, as Z_FIXED is usually only used in special circumstances.

Rsync does the compression in-transit using zlib. As rsync uses vulnerable zlib v1.2.8 package, which incorrectly handles memory when performing certain zlib compressing or deflating operations. This results in rsync to crash.

Note - The issue wasn't publicly labelled as security vulnerability until 2022, but the fix was public since 2018.

Affected upstream versions: n/a
Fixed upstream versions: v1.2.12
Upstream repository: https://github.com/madler/zlib
Upstream fix commit: 5c44459c3b28a9bd3283aaceab7c615f8020c531
CVE-2018-25091: urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect
Component: urllib3
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2023-10-15T00:00:00+00:00

A flaw was found in the urllib3 package. Affected versions of this package are vulnerable to information exposure through sent data when the authorization HTTP header is not removed during a cross-origin redirect. An attacker can expose credentials in the authorization header to unintended hosts or transmit them in clear text by exploiting the incomplete fix for CVE-2018-20060.

Statement: This is only exploitable if a redirect differs in host, port, or scheme. Due to the credential exposure in the authorization header, the confidentiality is highly impacted, but there is no proof that the integrity is affected in any way.

Affected upstream versions: n/a
Fixed upstream versions: 1.25
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: adb358f8e06865406d1f05e581a16cbea2136fbc
CVE-2018-3721: lodash: Prototype pollution in utilities function
Component: lodash
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 2.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-02-15T00:00:00+00:00

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Statement: Red Hat CloudForms version 4.7 does not ship component lodash, so isn't affected by this flaw.

Red Hat Virtualization 4.2 EUS includes a vulnerable version of lodash as part of the ovirt-engine-dashboard package. This package has been removed from Red Hat Virtualization 4.3.

Affected upstream versions: Versions before 4.17.5
Fixed upstream versions: 4.17.5
Upstream repository: https://github.com/lodash/lodash
Upstream fix commit: d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
CVE-2018-3728: hoek: Prototype pollution in utilities function
Component: hoek
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 2.9 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-02-15T00:00:00+00:00

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Statement: Red Hat Quay includes hoek as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.

Affected upstream versions: Versions before 5.0.3
Fixed upstream versions: v5.0.3
Upstream repository: https://github.com/hapijs/hoek
Upstream fix commit: 32ed5c9413321fbc37da5ca81a7cbab693786dee
CVE-2018-3741: rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability
Component: rubygem-rails-html-sanitizer
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2018-03-21T00:00:00+00:00

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

Statement: This issue affects the versions of rubygem-rails-html-sanitizer as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having a security  impact of Moderate. This vulnerability won't be fixed on CloudForms 4, because it uses libxml 2.9.1 and since the vulnerability requires a libxml >= 2.9.2 in order to be exploitable. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Affected upstream versions: <= 1.0.3
Fixed upstream versions: v1.0.4
Upstream repository: https://github.com/rails/rails-html-sanitizer
Upstream fix commit: f3ba1a839a35f2ba7f941c15e239a1cb379d56ae
CVE-2018-3760: rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
Component: rubygem-sprockets
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2018-06-20T00:00:00+00:00

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.


Affected upstream versions: 4.0.0.beta8, 3.7.2, 2.12.5
Upstream repository: https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets
Upstream fix commit: 18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5
CVE-2018-3774: nodejs-url-parse: incorrect hostname in url parsing
Component: nodejs-url-parse
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-07-30T00:00:00+00:00

A flaw was found in nodejs-url-parse. The wrong hostname can be returned, due to incorrect parsing, which can lead to a variety of vulnerabilities. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: 1.4.3
Fixed upstream versions: 1.4.3
Upstream repository: https://github.com/unshiftio/url-parse
Upstream fix commit: d7b582ec1243e8024e60ac0b62d2569c939ef5de
CVE-2018-5332: kernel: rds_message_alloc_sgs() function doesn't validate value used during DMA page allocation causes heap out-of-bounds write
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-01-02T00:00:00+00:00

In the Linux kernel through 4.14.13, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size() function in 'net/rds/rdma.c') and thus to a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future Linux kernel updates for the respective releases may address this issue.

This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 7, its real-time kernel, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE, as a code with the flaw is not built and shipped with the products listed.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c095508770aebf1b9218e77026e48345d719b17c
CVE-2018-5333: kernel: Null pointer dereference in rds_atomic_free_op() allowing denial-of-service
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-01-03T00:00:00+00:00

In the Linux kernel through 4.14.13, the rds_cmsg_atomic() function in 'net/rds/rdma.c' mishandles cases where page pinning fails or an invalid address is supplied by a user. This can lead to a NULL pointer dereference in rds_atomic_free_op() and thus to a system panic.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This is not currently planned to be addressed in future updates of the product due to its life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future Linux kernel updates for the respective releases may address this issue.

This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7, its real-time kernel, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE, as a code with the flaw is not built and shipped with the products listed.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7d11f77f84b27cef452cee332f4e469503084737
CVE-2018-5344: kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-01-06T00:00:00+00:00

A flaw was found in the Linux kernel's handling of loopback devices. An attacker, who has permissions to setup loopback disks, may create a denial of service or other unspecified actions.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2.

Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
CVE-2018-5390: kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack)
Component: kernel
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-08-06T00:00:00+00:00

A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A remote attacker could use this flaw to trigger time and calculation expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system. Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open port, thus the attacks cannot be performed using spoofed IP addresses.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/3553061

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64, and Red Hat Enterprise Linux 7 for Power 9. Future kernel updates for the respective releases will address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, but to a lesser degree. As such, the issue severity for RHEL5 is considered Moderate. This is not currently planned to be addressed in future updates of the product due to its life cycle and the issue severity. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: 4.9 < 4.9*
Fixed upstream versions: 4.9*
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
Upstream fix commit: 1a4f14bab1868b443f0dd3c55b689a478f82e72e
CVE-2018-5391: kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack)
Component: kernel
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-08-14T16:00:00+00:00

A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available. For additional information, please refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/3553061

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64, and Red Hat Enterprise Linux 7 for Power 9. Future kernel updates for the respective releases will address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, but to a lesser degree. As such, the issue severity for RHEL5 is considered Moderate. This is not currently planned to be addressed in future updates of the product due to its life cycle and the issue severity. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: 3.9 < 3.9*
Fixed upstream versions: 3.9*
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
Upstream fix commit: c30f1fc041b74ecdb072dd44f858750414b8b19f
CVE-2018-5729: krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
Component: krb5
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-03-01T00:00:00+00:00

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.17-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: e1caf6fb74981da62039846931ebdffed71309d1
CVE-2018-5730: krb5: DN container check bypass by supplying special crafted data
Component: krb5
Severity: Low
CWE: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
CVSS v3: 3.8 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
Public date: 2018-03-01T00:00:00+00:00

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.17-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: e1caf6fb74981da62039846931ebdffed71309d1
CVE-2018-5800: LibRaw: Heap-based buffer overflow in LibRaw::kodak_ycbcr_load_raw function in internal/dcraw_common.cpp
Component: LibRaw
Severity: Low
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-01-30T00:00:00+00:00

A heap-based out-of-bounds access flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images.


Affected upstream versions: Prior to 0.18.7
Fixed upstream versions: 0.18.7
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: 8682ad204392b914ab1cc6ebcca9c27c19c1a4b4
CVE-2018-5801: LibRaw: NULL pointer dereference in LibRaw::unpack function src/libraw_cxx.cpp
Component: LibRaw
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-01-30T00:00:00+00:00

A NULL pointer dereference flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images.


Affected upstream versions: Prior to 0.18.7
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: 0df5490b985c419de008d32168650bff17128914
CVE-2018-5802: LibRaw: Out-of-bounds read in kodak_radc_load_raw function internal/dcraw_common.cpp
Component: LibRaw
Severity: Low
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-01-30T00:00:00+00:00

An out-of-bounds read flaw was found in the way LibRaw processed images. An attacker could potentially use this flaw to crash applications using LibRaw by tricking them into processing crafted images.


Affected upstream versions: Prior to 0.18.7
Fixed upstream versions: 0.18.7
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: 8682ad204392b914ab1cc6ebcca9c27c19c1a4b4
CVE-2018-5803: kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-02-09T00:00:00+00:00

An error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP, packet length can be exploited by a malicious local user to cause a kernel crash and a DoS.


Affected upstream versions: Before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102.
Fixed upstream versions: v4.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
Upstream fix commit: 07f2c7ab6f8d0a7e7c5764c4e6cc9c52951b9d9c
CVE-2018-5805: LibRaw: Stack-based buffer overflow in quicktake_100_load_raw() function in internal/dcraw_common.cpp
Component: LibRaw
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-03-14T00:00:00+00:00

LibRaw is vulnerable to stack-based buffer overflow in internal/dcraw_common.cpp:quicktake_100_load_raw() function when processing specially-crafted RAW data. An attacker could potentially use this flaw to cause an arbitrary code execution or denial of service.

Statement: This issue did not affect the versions of dcraw as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable code.

This issue affects the versions of dcraw as shipped with Red Hat Enterprise Linux 6. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: Prior to 0.18.8
Fixed upstream versions: 0.18.8
Upstream repository: https://github.com/LibRaw/LibRaw
Upstream fix commit: 9f26ce37f5be86ea11bfc6831366558650b1f6ff