huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2012-2313: kernel: unfiltered netdev rio_ioctl access by users
Component: kernel
Severity: Low
Public date: 2012-04-26T00:00:00+00:00

The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.


Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 1bb57e940e1958e40d51f2078f50c3a96a9b2d75
CVE-2012-2318: pidgin: Improper validation of incoming plaintext messages in MSN protocol plug-in
Component: pidgin
Severity: Moderate
Public date: 2012-05-06T00:00:00+00:00

msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: 4d6bcb4f4ea4
CVE-2012-2319: kernel: Buffer overflow in the HFS plus filesystem (different issue than CVE-2009-4020)
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2012-05-04T00:00:00+00:00

Multiple buffer overflows in the hfsplus filesystem implementation in the Linux kernel before 3.3.5 allow local users to gain privileges via a crafted HFS plus filesystem, a related issue to CVE-2009-4020.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG, as those versions do not have CONFIG_HFSPLUS_FS option enabled.

The Red Hat Security Response Team has rated this issue as having low security impact. A future kernel updates in Red Hat Enterprise Linux 5 may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6f24f892871acc47b40dd594c63606a17c714f77
CVE-2012-2334: libreoffice: Integer overflow leading to buffer overflow by processing invalid  Escher graphics records length in the Powerpoint documents
Component: libreoffice
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-05-16T00:00:00+00:00

Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher graphics record in a PowerPoint (.ppt) document, which triggers a buffer overflow.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/libreoffice/core
Upstream fix commit: 512401decb286ba0fc3031939b8f7de8649c502e
CVE-2012-2370: gdk-pixbuf: DoS (GLib error and application abort) due to an integer overflow in the XBM image file format loader
Component: gdk-pixbuf
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-03-25T00:00:00+00:00

Multiple integer overflows in the read_bitmap_file_data function in io-xbm.c in gdk-pixbuf before 2.26.1 allow remote attackers to cause a denial of service (application crash) via a negative (1) height or (2) width in an XBM file, which triggers a heap-based buffer overflow.

Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: 2.26.1
Upstream repository: https://git.gnome.org/browse/gdk-pixbuf
Upstream fix commit: b1bb3053856aede37d473c92f0e5a10e29f10516
CVE-2012-2372: kernel: rds-ping cause kernel panic
Component: kernel
Severity: Moderate
Public date: 2012-06-05T00:00:00+00:00

The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux MRG. Future kernel updates for Red Hat Enterprise Linux 5 and 6 may address this issue.

Affected upstream versions: n/a
Upstream repository: https://oss.oracle.com/git/redpatch.git
Upstream fix commit: c7b6a0a1d8d636852be130fa15fa8be10d4704e8
CVE-2012-2373: kernel: mm: read_pmd_atomic: 32bit PAE pmd walk vs pmd_populate SMP race condition
Component: kernel
Severity: Moderate
Public date: 2012-05-17T00:00:00+00:00

The Linux kernel before 3.4.5 on the x86 platform, when Physical Address Extension (PAE) is enabled, does not properly use the Page Middle Directory (PMD), which allows local users to cause a denial of service (panic) via a crafted application that triggers a race condition.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG. Kernel update RHSA-2012:0743 https://rhn.redhat.com/errata/RHSA-2012-0743.html for Red Hat Enterprise Linux 6 did address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 26c191788f18129af0eb32a358cdaea0c7479626
CVE-2012-2375: kernel: incomplete fix for CVE-2011-4131
Component: kernel
Severity: Moderate
Public date: 2012-03-22T00:00:00+00:00

The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.


Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 20e0fa98b751facf9a1101edaefbc19c82616a68
CVE-2012-2383: kernel: drm/i915: integer overflow in i915_gem_execbuffer2()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-04-23T00:00:00+00:00

Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ed8cd3b2cd61004cab85380c52b1817aca1ca49b
CVE-2012-2384: kernel: drm/i915: integer overflow in i915_gem_do_execbuffer()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-04-23T00:00:00+00:00

Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG 2. This issue was addressed in Red Hat Enterprise Linux 6 via RHSA-2012:1304 https://rhn.redhat.com/errata/RHSA-2012-1304.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 44afb3a04391a74309d16180d1e4f8386fdfa745
CVE-2012-2386: php: Integer overflow leading to heap-buffer overflow in the Phar extension
Component: php
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2012-05-21T00:00:00+00:00

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

Statement: This issue did not affect the version of php as shipped with Red Hat Enterprise Linux 5 as it did not include support for phar extension yet. This issue was addressed in php53 package for Red Hat Enterprise Linux 5 via RHSA-2012:1047 and in php package for Red Hat Enterprise Linux 6 via RHSA-2012:1046.

Affected upstream versions: n/a
Fixed upstream versions: php-5.4.5
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 158d8a6b088662ce9d31e0c777c6ebe90efdc854
CVE-2012-2390: kernel: huge pages: memory leak on mmap failure
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
Public date: 2012-05-17T00:00:00+00:00

Memory leak in mm/hugetlb.c in the Linux kernel before 3.4.2 allows local users to cause a denial of service (memory consumption or system crash) via invalid MAP_HUGETLB mmap operations.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as they did not include the upstream commit 84afd99b that introduced this issue. Future kernel updates for Red Hat Enterprise Linux 6 may address this issue.

This has been addressed in Red Hat Enterprise Linux Red Hat Enterprise MRG 2 via https://rhn.redhat.com/errata/RHSA-2012-1150.html

Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: c50ac050811d6485616a193eb0f37bfbd191cc89
CVE-2012-2395: cobbler: command injection flaw in the power management XML-RPC API
Component: cobbler
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Public date: 2012-04-23T00:00:00+00:00

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

Statement: This issue did not affect the version of cobbler as shipped with Red Hat Network Satellite Server 5.3.0, as it did not include the upstream commit 0e5f6f2d50d460f4c6b0c9f62cfed0ff5c546906 that introduced this flaw. This issue affects the version of cobbler as shipped with Red Hat Network Satellite Server 5.4.0.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.0
Upstream repository: https://github.com/cobbler/cobbler
Upstream fix commit: 6d9167e5da44eca56bdf42b5776097a6779aaadf
CVE-2012-2625: xen: pv bootloader doesn't check the size of the bzip2 or lzma compressed kernel
Component: xen
Severity: Moderate
Public date: 2012-05-04T00:00:00+00:00

The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.


Affected upstream versions: n/a
Upstream repository: https://xenbits.xensource.com/hg/xen-unstable.hg
Upstream fix commit: 60f09d1ab1fe
CVE-2012-2668: openldap: does not honor TLSCipherSuite settings
Component: openldap
Severity: Low
Public date: 2012-06-04T00:00:00+00:00

libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.

Statement: This issue did not affect the version of openldap as shipped with Red Hat Enterprise Linux 5, as it does not use the Mozilla NSS backend.

Affected upstream versions: n/a
Upstream repository: https://www.openldap.org/devel/openldap.git
Upstream fix commit: 2c2bb2e
CVE-2012-2673: gc: malloc() and calloc() overflows
Component: gc
Severity: Moderate
Public date: 2012-06-05T00:00:00+00:00

Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.


Affected upstream versions: n/a
Fixed upstream versions: gc7_4_0
Upstream repository: https://github.com/ivmai/bdwgc
Upstream fix commit: e10c1eb9908c2774c16b3148b30d2f3823d66a9a
CVE-2012-2744: kernel: netfilter: null pointer dereference in nf_ct_frag6_reasm()
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2012-07-10T00:00:00+00:00

net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as they did not include support for netfilter's ipv6 connection tracking module. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux MRG as they already contain the upstream commit that fixes this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9e2dcf72023d1447f09c47d77c99b0c49659e5ce
CVE-2012-2745: kernel: cred: copy_process() should clear child->replacement_session_keyring
Component: kernel
Severity: Moderate
Public date: 2012-07-10T00:00:00+00:00

The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red 
Hat Enterprise Linux 5 as they did not include support for 
KEYCTL_SESSION_TO_PARENT keyctl IOCTL as introduced in upstream commit ee18d64c. 
This issue did not affect the versions of the Linux kernel as shipped with Red 
Hat Enterprise Linux MRG 2 as they already contain the fix.

This issue was addressed in Red Hat Enterprise Linux 6 via RHSA-2012:1064 https://rhn.redhat.com/errata/RHSA-2012-1064.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 79549c6dfda0603dba9a70a53467ce62d9335c33
CVE-2012-2893: libxslt: Heap-double-free in xmlFreeNodeList
Component: libxslt
Severity: Low
Public date: 2012-09-25T00:00:00+00:00

Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms.


Affected upstream versions: n/a
Upstream repository: https://git.chromium.org/gitweb/chromium.git
Upstream fix commit: 9a5da8e7d4b6f3454614b0331a51bf29c966f556
CVE-2012-3374: pidgin: Stack-based buffer overwrite in MXit protocol libPurple plug-in
Component: pidgin
Severity: Moderate
Public date: 2012-07-05T00:00:00+00:00

Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.


Affected upstream versions: n/a
Upstream repository: https://hg.pidgin.im/pidgin/main
Upstream fix commit: ded93865ef42
CVE-2012-3375: kernel: epoll: can leak file descriptors when returning -ELOOP
Component: kernel
Severity: Moderate
Public date: 2012-03-27T00:00:00+00:00

The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, since updates fixing CVE-2011-1083 contained a corrected patch that did not introduce this regression. 

This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-1061.html, and Red Hat Enterprise Linux Red Hat Enterprise MRG 2 via https://rhn.redhat.com/errata/RHSA-2012-1150.html

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 13d518074a952d33d47c428419693f63389547e9
CVE-2012-3386: automake: locally exploitable "make distcheck" bug
Component: automake
Severity: Low
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Public date: 2012-07-09T00:00:00+00:00

It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running "make distcheck".


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/automake.git
Upstream fix commit: 784b3e6ccc7c72a1c95c340cbbe8897d6b689d76
CVE-2012-3400: kernel: udf: buffer overflow when parsing sparing table
Component: kernel
Severity: Low
Public date: 2012-06-27T00:00:00+00:00

Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.

Statement: This issue does affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

The Red Hat Security Response Team has rated this issue as having low security 
impact. A future kernel updates may address this issue. For additional 
information, refer to the Issue Severity Classification:
https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: adee11b2085bee90bd8f4f52123ffb07882d6256
CVE-2012-3411: libvirt+dnsmasq: DNS configured to answer DNS queries from non-virtual networks
Component: libvirt+dnsmasq
Severity: Moderate
Public date: 2012-07-09T00:00:00+00:00

Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.

Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v2.64
Upstream repository: https://thekelleys.org.uk/gitweb/dnsmasq.git
Upstream fix commit: 2f38141f434e23292f84cefc33e8de76fb856147
CVE-2012-3412: kernel: sfc: potential remote denial of service through TCP MSS option
Component: kernel
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
Public date: 2012-07-30T00:00:00+00:00

The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.


Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 68cb695ccecf949d48949e72f8ce591fdaaa325c
CVE-2012-3417: quota: incorrect use of tcp_wrappers
Component: quota
Severity: Low
Public date: 2009-04-22T00:00:00+00:00

The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.


Affected upstream versions: n/a
Upstream repository: https://linuxquota.git.sourceforge.net/git/linuxquota/linuxquota
Upstream fix commit: 0abbfe92536fa5854eb65572de0cf131f80e2387
CVE-2012-3423: icedtea-web: incorrect handling of not 0-terminated strings
Component: icedtea-web
Severity: Important
Public date: 2012-07-31T00:00:00+00:00

The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea-web-1.2
Upstream fix commit: d65bd94e0ba9
CVE-2012-3429: bind-dyndb-ldap: named DoS via DNS query with $ in name
Component: bind-dyndb-ldap
Severity: Important
Public date: 2012-08-01T00:00:00+00:00

The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished names (DN) for LDAP queries, which allows remote DNS servers to cause a denial of service (named service hang) via a "$" character in a DN in a DNS query.


Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/cgit/bind-dyndb-ldap.git
Upstream fix commit: f345805c73c294db42452ae966c48fbc36c48006
CVE-2012-3430: kernel: recv{from,msg}() on an rds socket can leak kernel memory
Component: kernel
Severity: Low
Public date: 2012-07-23T00:00:00+00:00

The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.

Statement: The Red Hat Security Response Team has rated this issue as having low security 
impact. A future kernel updates may address this issue. For additional 
information, refer to the Issue Severity Classification:
https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: v3.6
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 06b6a1cf6e776426766298d055bb3991957d90a7
CVE-2012-3491: condor: local users can abort any idle jobs
Component: condor
Severity: Low
Public date: 2012-09-19T00:00:00+00:00

src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors.


Affected upstream versions: n/a
Upstream repository: https://condor-git.cs.wisc.edu/condor.git
Upstream fix commit: 1fff5d40