huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2013-0401: OpenJDK: sun.awt.datatransfer.ClassLoaderObjectInputStream class may incorrectly invoke the system class loader (CanSecWest 2013, AWT, 8009305)
Component: OpenJDK
Severity: Critical
Public date: 2013-04-16T00:00:00+00:00

The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.


Affected upstream versions: n/a
Upstream repository: https://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk
Upstream fix commit: 31c782610044
CVE-2013-0424: OpenJDK: RMI CGIHandler XSS issue (RMI, 6563318)
Component: OpenJDK
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 6e173569e1e7
CVE-2013-0425: OpenJDK: logging insufficient access control checks (Libraries, 6664509)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: ce105dd2e4de
CVE-2013-0426: OpenJDK: logging insufficient access control checks (Libraries, 6664528)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: ce105dd2e4de
CVE-2013-0427: OpenJDK: invalid threads subject to interrupts (Libraries, 6776941)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 87d135824bdf
CVE-2013-0428: OpenJDK: reflection API incorrect checks for proxy classes (Libraries, 7197546, SE-2012-01 Issue 29)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: c9534e095b37
CVE-2013-0429: OpenJDK: PresentationManager incorrectly shared (CORBA, 7141694)
Component: OpenJDK
Severity: Important
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba
Upstream fix commit: c1ed8145c1b8
CVE-2013-0432: OpenJDK: insufficient clipboard access premission checks (AWT, 7186952)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: e46d557465da
CVE-2013-0433: OpenJDK: InetSocketAddress serialization issue (Networking, 7201071)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: ab011765c4e8
CVE-2013-0434: OpenJDK: loadPropertyFile missing restrictions (JAXP, 8001235)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jaxp
Upstream fix commit: 91fcc41a0b4b
CVE-2013-0435: OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: c1fa21042291
CVE-2013-0440: OpenJDK: CPU consumption DoS via repeated SSL ClientHello packets (JSSE, 7192393)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE.  NOTE: the previous information is from the February 2013 CPU.  Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 5c1e8b779c65
CVE-2013-0441: OpenJDK: missing serialization restriction (CORBA, 7201066)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba
Upstream fix commit: 307ddc7799c7
CVE-2013-0442: OpenJDK: insufficient privilege checking issue (AWT, 7192977)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 6527ae06da69
CVE-2013-0443: OpenJDK: insufficient Diffie-Hellman public key checks (JSSE, 7192392)
Component: OpenJDK
Severity: Moderate
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 496bced2d275
CVE-2013-0444: OpenJDK: MethodFinder insufficient checks for cached results (Beans, 7200493)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: ce04db4aba39
CVE-2013-0445: OpenJDK: insufficient privilege checking issue (AWT, 8001057)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 6527ae06da69
CVE-2013-0450: OpenJDK: RequiredModelMBean missing access control context checks (JMX, 8000537)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: 6e0d9f4942af
CVE-2013-0871: kernel: race condition with PTRACE_SETREGS
Component: kernel
Severity: Important
Public date: 2013-02-15T00:00:00+00:00

Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.

Statement: This issue did affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2. Future updates may address this issue.

Please note that while a public non-weaponized exploit exists, according to our testing the issue is very hard to hit.

Affected upstream versions: n/a
Fixed upstream versions: v3.8
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9899d11f654474d2d54ea52ceaa2a1f4db3abd68
CVE-2013-0913: Kernel: drm/i915: heap writing overflow
Component: Kernel
Severity: Important
Public date: 2013-03-11T00:00:00+00:00

Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.

Statement: This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2.  Future kernel updates for Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Upstream repository: https://git.chromium.org/gitweb/chromiumos/third_party/kernel.git
Upstream fix commit: c79efdf2b7f68f985922a8272d64269ecd490477
CVE-2013-0914: Kernel: sa_restorer information leak
Component: Kernel
Severity: Low
Public date: 2013-03-11T00:00:00+00:00

The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.

Statement: This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2ca39528c01a933f6689cd6505ce65bd6d68a530
CVE-2013-1415: krb5: PKINIT null pointer deref leads to DoS  (pkinit_check_kdc_pkid())
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-02-15T00:00:00+00:00

The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.

Statement: This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5 as they did not include support for PKINIT.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.11.1-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: f249555301940c6df3a2cdda13b56b5674eebc2e
CVE-2013-1416: krb5: NULL pointer dereference (DoS, KDC crash) by processing certain TGS requests
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-03-29T00:00:00+00:00

The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.

Statement: This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 4 and 5.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.10.5-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 8ee70ec63931d1e38567905387ab9b1d45734d81
CVE-2013-1418: krb5: multi-realm KDC null dereference leads to crash
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-11-04T00:00:00+00:00

It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.10.7-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: c2ccf4197f697c4ff143b8a786acdd875e70a89d
CVE-2013-1475: OpenJDK: IIOP type reuse sandbox bypass (CORBA, 8000540, SE-2012-01 Issue 50)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba
Upstream fix commit: 127e4c348a71
CVE-2013-1476: OpenJDK: missing ValueHandlerImpl class constructor access restriction (CORBA, 8000631)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba
Upstream fix commit: 5116fe321210
CVE-2013-1478: OpenJDK: image parser insufficient raster parameter checks (2D, 8001972)
Component: OpenJDK
Severity: Critical
Public date: 2013-02-01T00:00:00+00:00

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk
Upstream fix commit: d89bd26ac435