huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2015-2301: php: use after free in phar_object.c
Component: php
Severity: Low
CWE: CWE-416 (Use After Free)
Public date: 2015-01-24T00:00:00+00:00

A use-after-free flaw was found in PHP's phar (PHP Archive) paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.22
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: b2cf3f064b8f5efef89bb084521b61318c71781b
CVE-2015-2348: php: move_uploaded_file() NUL byte injection in file name
Component: php
Severity: Moderate
CWE: CWE-626 (Null Byte Interaction Error (Poison Null Byte))
Public date: 2015-03-02T00:00:00+00:00

It was found that PHP move_uploaded_file() function did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.

Statement: This issue does not affect the current php and php53 packages in Red Hat Enterprise Linux 5 and 6, as it was previously corrected as part of the fix for CVE-2006-7243.

Affected upstream versions: n/a
Fixed upstream versions: php-5.4.39
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: 1291d6bbee93b6109eb07e8f7916ff1b7fcc13e1
CVE-2015-2666: kernel: execution in the early microcode loader
Component: kernel
Severity: Moderate
Public date: 2015-02-19T00:00:00+00:00

A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enteprise MRG 2. Future kernel and kernel-rt updates for Red Hat Enterprise Linux 7 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4
CVE-2015-2675: rest: memory corruption when using oauth because of implicit declaration of rest_proxy_call_get_url
Component: rest
Severity: Low
CWE: CWE-704 (Incorrect Type Conversion or Cast)
Public date: 2014-09-03T00:00:00+00:00

It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the rest_proxy_call_get_url call. An attacker could use this flaw to crash an application using the librest library.


Affected upstream versions: n/a
Fixed upstream versions: 0.7.93
Upstream repository: https://git.gnome.org/browse/librest
Upstream fix commit: b50ace7738ea03817acdad87fb2b338a86018329
CVE-2015-2694: krb5: issues in OTP and PKINIT kdcpreauth modules leading to requires_preauth bypass
Component: krb5
Severity: Moderate
Public date: 2015-04-27T00:00:00+00:00

A flaw was found in the OTP kdcpreauth module of MIT Kerberos. A remote attacker could use this flaw to bypass the requires_preauth flag on a client principal and obtain a ciphertext encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line dictionary attack against the user's password.

Statement: This issue does not affect the version of krb5 package as shipped with Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.14-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: e3b5a5e5267818c97750b266df50b6a3d4649604
CVE-2015-2716: expat: Integer overflow leading to buffer overflow in XML_GetBuffer()
Component: expat
Severity: Critical
Public date: 2015-05-12T00:00:00+00:00

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.

Statement: This issue affects the version of expat package as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update may address this flaw.

Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.

Affected upstream versions: n/a
Upstream repository: https://hg.mozilla.org/releases/mozilla-esr31
Upstream fix commit: 2f3e78643f5c
CVE-2015-2806: libtasn1: stack overflow in asn1_der_decoding
Component: libtasn1
Severity: Low
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2015-03-26T00:00:00+00:00

A stack-based buffer overflow was found in the way libtasn1 decoded certain DER encoded data. An attacker could use this flaw to crash an application using the libtasn1 library.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/gitweb/libtasn1.git
Upstream fix commit: 4d4f992826a4962790ecd0cce6fbba4a415ce149
CVE-2015-2830: kernel: int80 fork from 64-bit tasks mishandling
Component: kernel
Severity: Low
CWE: CWE-393 (Return of Wrong Status Code)
Public date: 2015-04-01T00:00:00+00:00

A flaw was found in the way the Linux kernel's 32-bit emulation implementation handled forking or closing of a task with an 'int80' entry. A local user could potentially use this flaw to escalate their privileges on the system.

Statement: This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and
maintenance life cycle. This has been rated as having Low security
impact and is not currently planned to be addressed in future updates. For
additional information, refer to the Red Hat Enterprise Linux Life
Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 956421fbb74c3a6261903f3836c0740187cf038b
CVE-2015-2922: kernel: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements.
Component: kernel
Severity: Low
CWE: CWE-454 (External Initialization of Trusted Variables or Data Stores)
Public date: 2015-03-24T00:00:00+00:00

It was found that the Linux kernel's TCP/IP protocol suite implementation for IPv6 allowed the Hop Limit value to be set to a smaller value than the default one. An attacker on a local network could use this flaw to prevent systems on that network from sending or receiving network packets.

Statement: This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel
updates for Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 may
address this issue.

Red Hat Enterprise Linux 5 is now in Production 3 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v4.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6fd99094de2b83d1d4c8457f2c83483b2828e75a
CVE-2015-2925: Kernel: vfs: Do not allow escaping from bind mounts
Component: Kernel
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
Public date: 2015-04-03T00:00:00+00:00

A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their privileges on the system.

Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5.

This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6 and 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Upstream repository: https://pkgs.fedoraproject.org/cgit/kernel.git
Upstream fix commit: 520b64102de2f184036024b2a53de2b67463bd78
CVE-2015-3010: ceph-deploy: keyring permissions are world readable in ~ceph
Component: ceph-deploy
Severity: Moderate
CWE: CWE-732 (Incorrect Permission Assignment for Critical Resource)
Public date: 2015-03-05T00:00:00+00:00

It was discovered that ceph-deploy, a utility for deploying Red Hat Ceph Storage, would create the keyring file with world readable permissions, which could possibly allow a local user to obtain authentication credentials from the keyring file.


Affected upstream versions: n/a
Fixed upstream versions: v1.5.23
Upstream repository: https://github.com/ceph/ceph-deploy
Upstream fix commit: eee56770393bf19ed2dd5389226c6190c08dee3f
CVE-2015-3147: abrt: does not validate contents of uploaded problem reports
Component: abrt
Severity: Low
CWE: CWE-283 (Unverified Ownership)
Public date: 2015-04-17T00:00:00+00:00

It was discovered that, when moving problem reports between certain directories, abrt-handle-upload did not verify that the new problem directory had appropriate permissions and did not contain symbolic links. An attacker able to create a crafted problem report could use this flaw to expose other parts of ABRT, or to overwrite arbitrary files on the system.


Affected upstream versions: before 2.6.0
Fixed upstream versions: 2.6.0
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: 3746b7627218438ae7d781fc8b18a221454e9091
CVE-2015-3150: abrt: abrt-dbus does not guard against crafted problem directory path arguments
Component: abrt
Severity: Important
CWE: CWE-20 (Improper Input Validation)
Public date: 2015-04-22T00:00:00+00:00

It was discovered that the abrt-dbus D-Bus service did not properly check the validity of the problem directory argument in the ChownProblemDir, DeleteElement, and DeleteProblem methods. A local attacker could use this flaw take ownership of arbitrary files and directories, or to delete files and directories as the root user.


Affected upstream versions: before 1951e7282043dfe1268d492aea056b554baedb75
Fixed upstream versions: 2.1.11-20.el7
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: 6e811d78e2719988ae291181f5b133af32ce62d8
CVE-2015-3151: abrt: directory traversals in several D-Bus methods implemented by abrt-dbus
Component: abrt
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
Public date: 2015-04-22T00:00:00+00:00

Multiple directory traversal flaws were found in the abrt-dbus D-Bus service. A local attacker could use these flaws to read and write arbitrary files as the root user.


Affected upstream versions: before 7a47f57975be0d285a2f20758e4572dca6d9cdd3
Fixed upstream versions: 2.1.11-20.el7
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: c796c76341ee846cfb897ed645bac211d7d0a932
CVE-2015-3152: mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)
Component: mysql
Severity: Moderate
Public date: 2015-04-29T00:00:00+00:00

It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server.


Affected upstream versions: n/a
Fixed upstream versions: mysql-5.7.3
Upstream repository: https://github.com/mysql/mysql-server
Upstream fix commit: 3bd5589e1a5a93f9c224badf983cd65c45215390
CVE-2015-3159: abrt: missing process environment sanitizaton in abrt-action-install-debuginfo-to-abrt-cache
Component: abrt
Severity: Important
CWE: CWE-20 (Improper Input Validation)
Public date: 2015-04-29T00:00:00+00:00

It was discovered that the abrt-action-install-debuginfo-to-abrt-cache helper program did not properly filter the process environment before invoking abrt-action-install-debuginfo. A local attacker could use this flaw to escalate their privileges on the system.


Affected upstream versions: before 9a4100678fea4d60ec93d35f4c5de2e9ad054f3a
Fixed upstream versions: 2.1.11-20.el7
Upstream repository: https://github.com/abrt/abrt
Upstream fix commit: 9943a77bca37a0829ccd3784d1dfab37f8c24e7b
CVE-2015-3182: wireshark: crash on sample file genbroad.snoop
Component: wireshark
Severity: Moderate
CWE: CWE-704 (Incorrect Type Conversion or Cast)
Public date: 2015-05-07T00:00:00+00:00

epan/dissectors/packet-dec-dnart.c in the DECnet NSP/RT dissector in Wireshark 1.10.12 through 1.10.14 mishandles a certain strdup return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Affected upstream versions: n/a
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 373deb5f4182a5c4ab8c8418a7bbaa5d6e72bb05
CVE-2015-3183: httpd: HTTP request smuggling attack against chunked request parser
Component: httpd
Severity: Moderate
CWE: CWE-172 (Encoding Error)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2015-07-15T00:00:00+00:00

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks.


Affected upstream versions: n/a
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: e427c41257957b57036d5a549b260b6185d1dd73
CVE-2015-3185: httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4
Component: httpd
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2015-07-15T00:00:00+00:00

It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied.


Affected upstream versions: n/a
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: cd2b7a26c776b0754fb98426a67804fd48118708
CVE-2015-3194: OpenSSL: Certificate verify crash with missing PSS parameter
Component: OpenSSL
Severity: Low
Public date: 2016-01-28T00:00:00+00:00

A NULL pointer dereference flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacker could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2e
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: c394a488942387246653833359a5c94b5832674e
CVE-2015-3195: OpenSSL: X509_ATTRIBUTE memory leak
Component: OpenSSL
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2015-12-03T00:00:00+00:00

A memory leak vulnerability was found in the way OpenSSL parsed PKCS#7 and CMS data. A remote attacker could use this flaw to cause an application that parses PKCS#7 or CMS data from untrusted sources to use an excessive amount of memory and possibly crash.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2e
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: cc598f321fbac9c04da5766243ed55d55948637d
CVE-2015-3196: OpenSSL: Race condition handling PSK identify hint
Component: OpenSSL
Severity: Low
Public date: 2015-12-03T00:00:00+00:00

A race condition flaw, leading to a double free, was found in the way OpenSSL handled pre-shared key (PSK) identify hints. A remote attacker could use this flaw to crash a multi-threaded SSL/TLS client using OpenSSL.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2d
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 3c66a669dfc7b3792f7af0758ea26fe8502ce70c
CVE-2015-3197: OpenSSL: SSLv2 doesn't block disabled ciphers
Component: OpenSSL
Severity: Low
Public date: 2016-01-28T00:00:00+00:00

A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks.

Statement: This security flaw can only be exploited when a malicious client negotiates SSLv2 ciphers and completes a SSLv2 handshake. This flaw cannot be actively exploited by a Man-In-The-Middle attacker. 

All versions of OpenSSL shipped with Red Hat Enterprise Linux enable SSLv2 protocol, but disable SSLv2 ciphers by default (in Red Hat Enterprise Linux 6 and later), therefore are vulnerable to this flaw. Red Hat Product Security has rated this issue as having Low security impact, a future update may address this flaw.

SSLv2 suffers from a number of security flaws allowing attackers to capture and alter information passed between a client and the server. Therefore we strongly recommend that SSLv2 should be disabled on all the SSL/TLS servers.

Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2f
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: d81a1600588b726c2bdccda7efad3cc7a87d6245
CVE-2015-3201: thermostat: world-readable configuration file containing credentials
Component: thermostat
Severity: Moderate
CWE: CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory)
Public date: 2015-05-20T00:00:00+00:00

It was discovered that the Thermostat web application stored database authentication credentials in a world-readable configuration file. A local user on a system running the Thermostat web application could use this flaw to access and modify monitored JVM data, or perform actions on connected JVMs.


Affected upstream versions: n/a
Upstream repository: https://icedtea.classpath.org/hg/thermostat
Upstream fix commit: c2f18f81f57a
CVE-2015-3212: kernel: SCTP race condition allows list corruption and panic from userlevel
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
Public date: 2015-06-30T00:00:00+00:00

A race condition flaw was found in the way the Linux kernel's SCTP implementation handled Address Configuration lists when performing Address Configuration Change (ASCONF). A local attacker could use this flaw to crash the system via a race condition triggered by setting certain ASCONF options on a socket.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 5.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v4.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2d45a02d0166caf2627fe91897c6ffc3b19514c4
CVE-2015-3213: clutter: screenlock bypass by performing certain mouse gestures
Component: clutter
Severity: Moderate
CWE: CWE-414 (Missing Lock Check)
Public date: 2015-06-02T00:00:00+00:00

A flaw was found in the way clutter processed certain mouse and touch gestures. An attacker could use this flaw to bypass the screen lock.


Affected upstream versions: n/a
Fixed upstream versions: 1.17.2
Upstream repository: https://git.gnome.org/browse/clutter
Upstream fix commit: 97724939c8de004d7fa230f3ff64862d957f93a9
CVE-2015-3214: qemu/kvm: i8254: out-of-bounds memory access in pit_ioport_read function
Component: qemu/kvm
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2015-06-16T00:00:00+00:00

An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process.

Statement: This issue does not affect the versions of the qemu and qemu-kvm packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise Linux 6 based versions of qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. 

This issue does affect the Red Hat Enterprise Linux 7 qemu-kvm and Red Hat Enterprise Linux 7 based versions of the qemu-kvm-rhev packages as shipped with Red Hat Enterprise Virtualization 3. Future updates for the respective releases may address this flaw.

Please note that by default QEMU/KVM guests use in-kernel (KVM) PIT emulation
in which case the following applies:

This issue does not affect the Linux kernel versions as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise Linux MRG 2.

This issue does affect the kvm package as shipped with Red Hat Enterprise Linux 5. 

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ee73f656a604d5aa9df86a97102e4e462dd79924
CVE-2015-3215: virtio-win: netkvm: malformed packet can cause BSOD
Component: virtio-win
Severity: Important
CWE: CWE-20 (Improper Input Validation)
Public date: 2014-12-15T00:00:00+00:00

It was found that the Windows Virtio NIC driver did not sufficiently sanitize the length of the incoming IP packets, as demonstrated by a packet with IP options present but the overall packet length not being adjusted to reflect the length of those options. A remote attacker able to send a specially crafted IP packet to the guest could use this flaw to crash that guest.

Statement: This issue does affect the virtio-win packages as shipped with Red Hat Enteprise Linux 6 and 7. Future updates for the respective releases will address this issue.

Affected upstream versions: n/a
Fixed upstream versions: virtio1.0_refactoring
Upstream repository: https://github.com/YanVugenfirer/kvm-guest-drivers-windows
Upstream fix commit: fbfa4d1083ea84c5429992ca3e996d7d4fbc8238
CVE-2015-3223: libldb: Remote DoS in Samba (AD) LDAP server
Component: libldb
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2015-12-16T00:00:00+00:00

A denial of service flaw was found in the ldb_wildcard_compare() function of libldb. A remote attacker could send a specially crafted packet that, when processed by an application using libldb (for example the AD LDAP server in Samba), would cause that application to consume an excessive amount of memory and crash.


Affected upstream versions: n/a
Fixed upstream versions: tevent-0.9.27
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: ec504dbf69636a554add1f3d5703dd6c3ad450b8