huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2013-2455: OpenJDK: getEnclosing* checks (Libraries, 8007812)
Component: OpenJDK
Severity: Moderate
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Libraries, a different vulnerability than CVE-2013-2443 and CVE-2013-2452.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect access checks by the (1) getEnclosingClass, (2) getEnclosingMethod, and (3) getEnclosingConstructor methods.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 5d5ca338574f
CVE-2013-2456: OpenJDK: ObjectOutputStream access checks (Serialization, 8008132)
Component: OpenJDK
Severity: Moderate
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality via unknown vectors related to Serialization.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper access checks for subclasses in the ObjectOutputStream class.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 141facdacbf0
CVE-2013-2457: OpenJDK: Proper class checking (JMX, 8008120)
Component: OpenJDK
Severity: Moderate
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to JMX.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is due to an incorrect implementation of "certain class checks" that allows remote attackers to bypass intended class restrictions.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: ffef9e05564e
CVE-2013-2458: OpenJDK: Method handles (Libraries, 8009424)
Component: OpenJDK
Severity: Moderate
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via "an error related to method handles."


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 9efb5fb77027
CVE-2013-2459: OpenJDK: Various AWT integer overflow checks (AWT, 8009071)
Component: OpenJDK
Severity: Critical
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "integer overflow checks."


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: c98afec1bf86
CVE-2013-2460: OpenJDK: tracing insufficient access checks (Serviceability, 8010209)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u/jdk
Upstream fix commit: 160cde99bb1a
CVE-2013-2461: OpenJDK: Missing check for valid DOMCanonicalizationMethod canonicalization algorithm (Libraries, 8014281)
Component: OpenJDK
Severity: Important
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.  NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm."


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: abe9ea5a50d2
CVE-2013-2463: OpenJDK: Incorrect image attribute verification (2D, 8012438)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image attribute verification" in 2D.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: b79d56eee18e
CVE-2013-2465: OpenJDK: Incorrect image channel verification (2D, 8012597)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 2a9c79db0040
CVE-2013-2469: OpenJDK: Incorrect image layout verification (2D, 8012601)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image layout verification" in 2D.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 64055b403176
CVE-2013-2470: OpenJDK: ImagingLib byte lookup processing (2D, 8011243)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "ImagingLib byte lookup processing."


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 89d9ec9e80c1
CVE-2013-2471: OpenJDK: Incorrect IntegerComponentRaster size checks (2D, 8011248)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks."


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 4c3d38927a26
CVE-2013-2472: OpenJDK: Incorrect ShortBandedRaster size checks (2D, 8011253)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ShortBandedRaster size checks" in 2D.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 3cd4bec64e31
CVE-2013-2473: OpenJDK: Incorrect ByteBandedRaster size checks (2D, 8011257)
Component: OpenJDK
Severity: Critical
Public date: 2013-06-18T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 259d4998ce2f
CVE-2013-2546: kernel: crypto: info leaks in report API
Component: kernel
Severity: Low
Public date: 2013-02-05T00:00:00+00:00

The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.

Statement: These issues do not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6. 

These issues do affect the version of Linux kernel as shipped with Red Hat
Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address
this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
CVE-2013-2547: kernel: crypto: info leaks in report API
Component: kernel
Severity: Low
Public date: 2013-02-05T00:00:00+00:00

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.

Statement: These issues do not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6. 

These issues do affect the version of Linux kernel as shipped with Red Hat
Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address
this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
CVE-2013-2548: kernel: crypto: info leaks in report API
Component: kernel
Severity: Low
Public date: 2013-02-05T00:00:00+00:00

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.

Statement: These issues do not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6. 

These issues do affect the version of Linux kernel as shipped with Red Hat
Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2 may address
this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
CVE-2013-2596: kernel: integer overflow in fb_mmap
Component: kernel
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2013-04-09T00:00:00+00:00

An integer overflow flaw was found in the way the Linux kernel's Frame Buffer device implementation mapped kernel memory to user space via the mmap syscall. A local user able to access a frame buffer device file (/dev/fb*) could possibly use this flaw to escalate their privileges on the system.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise MRG 2.

This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5. Future kernel updates for Red Hat Enterprise Linux 5 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b4cbb197c7e7a68dbad0d491242e3ca67420c13e
CVE-2013-2634: kernel: Information leak in the Data Center Bridging (DCB) component
Component: kernel
Severity: Low
Public date: 2013-03-09T00:00:00+00:00

net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Statement: This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5.

This issue does affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates
for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this
issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 29cd8ae0e1a39e239a3a7b67da1986add1199fc0
CVE-2013-2635: kernel: Information leak in the RTNETLINK component
Component: kernel
Severity: Low
Public date: 2013-03-09T00:00:00+00:00

The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Statement: This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5.

This issue does affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates
for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this
issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 84d73cd3fb142bf1298a8c13fd4ca50fd2432372
CVE-2013-2776: sudo: bypass of tty_tickets constraints
Component: sudo
Severity: Low
Public date: 2013-02-27T00:00:00+00:00

sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.


Affected upstream versions: n/a
Upstream repository: https://www.sudo.ws/repos/sudo
Upstream fix commit: 049a12a5cc14
CVE-2013-2777: sudo: bypass of tty_tickets constraints
Component: sudo
Severity: Low
Public date: 2013-02-27T00:00:00+00:00

sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.


Affected upstream versions: n/a
Upstream repository: https://www.sudo.ws/repos/sudo
Upstream fix commit: bfa23f089bba
CVE-2013-2850: kernel: iscsi-target: heap buffer overflow on large key error
Component: kernel
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2013-05-30T00:00:00+00:00

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and 6 as those versions do not provide support for in-kernel iSCSI target.

Future kernel updates in Red Hat Enterprise Linux MRG 2 may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v3.10
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: cea4dcfdad926a27a18e188720efe0f2c9403456
CVE-2013-2852: kernel: b43: format string leaking into error msgs
Component: kernel
Severity: Low
Public date: 2013-06-06T00:00:00+00:00

Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue does affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, and Red Hat Enterprise MRG. Future updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG may address this issue.

Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless.git
Upstream fix commit: 9538cbaab6e8b8046039b4b2eb6c9d614dc782bd
CVE-2013-2877: libxml2: Out-of-bounds read via a document that ends abruptly
Component: libxml2
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2013-07-09T00:00:00+00:00

parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.


Affected upstream versions: n/a
Upstream repository: https://git.chromium.org/gitweb/chromium/chromium.git
Upstream fix commit: e5d7f7e5dc21d3ae7be3cbb949ac4d8701e06de1
CVE-2013-2929: kernel: exec/ptrace: get_dumpable() incorrect tests
Component: kernel
Severity: Low
Public date: 2013-11-07T00:00:00+00:00

A flaw was found in the way the get_dumpable() function return value was interpreted in the ptrace subsystem of the Linux kernel. When 'fs.suid_dumpable' was set to 2, a local, unprivileged local user could use this flaw to bypass intended ptrace restrictions and obtain potentially sensitive information.


Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d049f74f2dbe71354d43d393ac3a188947811348
CVE-2013-2930: kernel: perf/ftrace: insufficient check in perf_trace_event_perm()
Component: kernel
Severity: Moderate
Public date: 2013-12-09T00:00:00+00:00

The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: v3.13
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 12ae030d54ef250706da5642fc7697cc60ad0df7
CVE-2013-3076: Kernel: crypto: algif - suppress sending source address information in recvmsg
Component: Kernel
Severity: Low
Public date: 2013-04-07T00:00:00+00:00

The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.

Statement: This issue does not affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6.

This issue affects the version of the kernel package as shipped with
Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise MRG 2
may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 72a763d805a48ac8c0bf48fdb510e84c12de51fe