huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2010-0003: kernel: infoleak if print-fatal-signals=1
Component: kernel
Severity: Moderate
Public date: 2010-01-08T00:00:00+00:00

The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.

Statement: A future update in Red Hat Enterprise MRG may address this flaw.

This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to this product being in Production 3 of its maintenance life-cycle, where only qualified security errata of important or critical impact are addressed.

For further information about Errata Support Policy, visit: https://access.redhat.com/support/policy/updates/errata/

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: b45c6e76bc2c72f6426c14bed64fdcbc9bf37cb0
CVE-2010-0007: kernel: netfilter: ebtables: enforce CAP_NET_ADMIN
Component: kernel
Severity: Low
Public date: 2010-01-08T00:00:00+00:00

net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which allows local users to bypass intended access restrictions and configure arbitrary network-traffic filtering via a modified ebtables application.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3, as it did not include support for ebtables.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: dce766af541f6605fa9889892c0280bab31c66ab
CVE-2010-0008: kernel: sctp remote denial of service
Component: kernel
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
Public date: 2010-03-16T00:00:00+00:00

The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for SCTP. It did not affect the version of Linux kernel as shipped with Red Hat Enterprise MRG as it has already had the fix to this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.23
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ece25dfa0991f65c4e1d26beb1c3c45bda4239b8
CVE-2010-0291: kernel: untangle the do_mremap()
Component: kernel
Severity: Important
Public date: 2009-12-07T00:00:00+00:00

The Linux kernel before 2.6.32.4 allows local users to gain privileges or cause a denial of service (panic) by calling the (1) mmap or (2) mremap function, aka the "do_mremap() mess" or "mremap/mmap mess."

Statement: The risks associated with fixing this bug are greater than the important severity security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 3 and 4. This issue was addressed in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0504.html and https://rhn.redhat.com/errata/RHSA-2010-0161.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ecc1a8993751de4e82eb18640d631dae1f626bd6
CVE-2010-0296: glibc: Improper encoding of names with certain special character in utilities for writing to mtab table
Component: glibc
Severity: Low
Public date: 2010-05-25T00:00:00+00:00

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.12
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: ab00f4eac8f4932211259ff87be83144f5211540
CVE-2010-0297: kvm-userspace-rhel5: usb-linux.c: fix buffer overflow
Component: kvm-userspace-rhel5
Severity: Moderate
Public date: 2009-10-04T00:00:00+00:00

Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 allows guest OS users to cause a denial of service (guest OS crash or hang) or possibly execute arbitrary code on the host OS via a crafted USB packet.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/qemu.git
Upstream fix commit: babd03fde68093482528010a5435c14ce9128e3f
CVE-2010-0307: kernel: DoS on x86_64
Component: kernel
Severity: Moderate
Public date: 2010-01-28T00:00:00+00:00

The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel before 2.6.32.8 on the x86_64 platform does not ensure that the ELF interpreter is available before a call to the SET_PERSONALITY macro, which allows local users to cause a denial of service (system crash) via a 32-bit application that attempts to execute a 64-bit application and then triggers a segmentation fault, as demonstrated by amd64_killer, related to the flush_old_exec function.

Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to this product being in Production 3 of its maintenance life-cycle, where only qualified security errata of important or critical impact are addressed.

For further information about Errata Support Policy, visit: https://access.redhat.com/support/policy/updates/errata/

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 221af7f87b97431e3ee21ce4b0e77d5411cf1549
CVE-2010-0410: kernel: OOM/crash in drivers/connector
Component: kernel
Severity: Moderate
Public date: 2010-02-02T00:00:00+00:00

drivers/connector/connector.c in the Linux kernel before 2.6.32.8 allows local users to cause a denial of service (memory consumption and system crash) by sending the kernel many NETLINK_CONNECTOR messages.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4, as they do not include support for kernel connectors. Future updates in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f98bfbd78c37c5946cc53089da32a5f741efdeb7
CVE-2010-0411: systemtap: Crash with systemtap script using __get_argv()
Component: systemtap
Severity: Moderate
Public date: 2010-01-29T00:00:00+00:00

Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local users to cause a denial of service (script crash, or system crash or hang) via a process with a large number of arguments, leading to a buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: release-1.2
Upstream repository: https://sourceware.org/git/systemtap.git
Upstream fix commit: a2d399c87a642190f08ede63dc6fc434a5a8363a
CVE-2010-0415: kernel: sys_move_pages infoleak
Component: kernel
Severity: Important
Public date: 2010-02-05T00:00:00+00:00

The do_pages_move function in mm/migrate.c in the Linux kernel before 2.6.33-rc7 does not validate node values, which allows local users to read arbitrary kernel memory locations, cause a denial of service (OOPS), and possibly have unspecified other impact by specifying a node that is not part of the kernel's node set.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4, as they do not include support for sys_move_pages. It was only introduced in kernel version 2.6.18 onwards. This issue was addressed in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0147.html and https://rhn.redhat.com/errata/RHSA-2010-0161.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 6f5a55f1a6c5abee15a0e878e5c74d9f1569b8b0
CVE-2010-0424: cronie: Race condition by setting timestamp of user's crontab file, when editing the file
Component: cronie
Severity: Low
Public date: 2010-02-18T00:00:00+00:00

The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.


Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/git/cronie.git
Upstream fix commit: 9e4a8fa5f9171fb724981f53879c9b20264aeb61
CVE-2010-0426: sudo: sudoedit option can possibly allow for arbitrary code execution
Component: sudo
Severity: Important
Public date: 2010-02-21T00:00:00+00:00

sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary directory, which allows local users to gain privileges via a crafted executable file, as demonstrated by a file named sudoedit in a user's home directory.

Statement: It did not affect the versions of the sudo package as shipped with Red Hat Enterprise Linux 3 and 4.

Affected upstream versions: n/a
Upstream repository: https://sudo.ws/repos/sudo
Upstream fix commit: 88f3181692fe
CVE-2010-0427: sudo: Fails to reset group permissions if runas_default set
Component: sudo
Severity: Important
Public date: 2009-04-27T00:00:00+00:00

sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command.

Statement: This issue did not affect the versions of the sudo packages as shipped with Red Hat Enterprise Linux 3 and 4.

Affected upstream versions: n/a
Upstream repository: https://sudo.ws/repos/sudo
Upstream fix commit: aa0b6c01c462
CVE-2010-0437: kernel: ipv6: fix ip6_dst_lookup_tail() NULL pointer dereference
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2008-09-09T00:00:00+00:00

The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4, as they do not include support for Optimistic Duplicate Address Detection (DAD) in IPv6.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.27
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b
CVE-2010-0442: postgresql: substring() negative length argument buffer overflow
Component: postgresql
Severity: Moderate
Public date: 2010-01-27T00:00:00+00:00

The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."


Affected upstream versions: n/a
Upstream repository: https://git.postgresql.org/postgresql.git
Upstream fix commit: 75dea10196c31d98d98c0bafeeb576ae99c09b12
CVE-2010-0547: samba: mount.cifs improper device name and mountpoint strings sanitization
Component: samba
Severity: Low
Public date: 2010-01-26T00:00:00+00:00

client/mount.cifs.c in mount.cifs in smbfs in Samba 3.4.5 and earlier does not verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.


Affected upstream versions: n/a
Fixed upstream versions: tevent-0.9.11
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: a065c177dfc8f968775593ba00dffafeebb2e054
CVE-2010-0622: kernel: futex: Handle user space corruption gracefully
Component: kernel
Severity: Moderate
Public date: 2010-02-02T00:00:00+00:00

The wake_futex_pi function in kernel/futex.c in the Linux kernel before 2.6.33-rc7 does not properly handle certain unlock operations for a Priority Inheritance (PI) futex, which allows local users to cause a denial of service (OOPS) and possibly have unspecified other impact via vectors involving modification of the futex value from user space.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4, as they do not include support for priority-inheriting futex. Future updates in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 51246bfd189064079c54421507236fd2723b18f3
CVE-2010-0733: postgresql: Integer overflow in hash table size calculation
Component: postgresql
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2009-12-14T00:00:00+00:00

Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.


Affected upstream versions: n/a
Upstream repository: https://git.postgresql.org/postgresql.git
Upstream fix commit: 64b057e6823655fb6c5d1f24a28f236b94dd6c54
CVE-2010-0741: qemu: Improper handling of erroneous data provided by Linux virtio-net driver
Component: qemu
Severity: Important
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
Public date: 2009-10-22T00:00:00+00:00

The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS, related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO).


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/virt/kvm/qemu-kvm.git
Upstream fix commit: 184bd0484533b725194fa517ddc271ffd74da7c9
CVE-2010-0743: scsi-target-utils: format string vulnerability
Component: scsi-target-utils
Severity: Important
CWE: CWE-134 (Use of Externally-Controlled Format String)
Public date: 2010-03-22T00:00:00+00:00

Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/linux/kernel/git/tomo/tgt.git
Upstream fix commit: 107d922706cd36f3bb79bcca9bc4678c32f22e59
CVE-2010-0787: samba: Race condition by mount (mount.cifs) operations
Component: samba
Severity: Low
Public date: 2010-01-26T00:00:00+00:00

client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory file.


Affected upstream versions: n/a
Fixed upstream versions: tevent-0.9.11
Upstream repository: https://git.samba.org/samba.git
Upstream fix commit: a0c31ec1c8d1220a5884e40d9ba6b191a04a24d5
CVE-2010-0830: glibc: ld.so d_tag signedness error in elf_get_dynamic_info
Component: glibc
Severity: Low
Public date: 2010-05-25T00:00:00+00:00

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header.


Affected upstream versions: n/a
Fixed upstream versions: fedora/glibc-2.11.90-10
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: db07e962b6ea963dbb345439f6ab9b0cf74d87c5
CVE-2010-0926: samba: insecure "wide links" default
Component: samba
Severity: Low
Public date: 2010-02-05T00:00:00+00:00

The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.

Statement: This issue was addressed in Samba packages in Red Hat Enterprise Linux 5. It did not affect Samba packages in Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this issue as having low security impact. There is no plan to address this flaw in Red Hat Enterprise Linux 4.

To prevent this issue, disable "wide links" or "unix extensions" in the Samba configuration file (/etc/samba/smb.conf) and restart smbd (service smb restart). Disabled "wide links" ensure that remote Samba clients will not have wide symbolic links (links pointing outside of the shared directory) resolved on the server side when processing requests from a client that does not support UNIX extensions. Disabled "unix extensions" prevents creation of wide links by malicious clients which support UNIX extensions. For further information, please view http://www.samba.org/samba/news/symlink_attack.html

Affected upstream versions: n/a
Fixed upstream versions: tevent-0.9.11
Upstream repository: https://gitweb.samba.org/samba.git
Upstream fix commit: bd269443e311d96ef495a9db47d1b95eb83bb8f4
CVE-2010-1084: kernel: bluetooth: potential bad memory access with sysfs files
Component: kernel
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
Public date: 2010-03-21T00:00:00+00:00

Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c.

Statement: This issue did not affect the version of the Linux kernel as shipped with Red Hat Enterprise 3 and 4, as it did not use sysfs files. A future update in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 101545f6fef4a0a3ea8daf0b5b880df2c6a92a69
CVE-2010-1086: kernel: dvb-core: DoS bug in ULE decapsulation code
Component: kernel
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
Public date: 2010-02-25T00:00:00+00:00

The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE.

Statement: This issue did not affect the version of the Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for ULE (Unidirectional Lightweight Encapsulation). We have included a fix for this issue in Red Hat Enterprise Linux 4 and 5 however the affected module is not build by default.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 29e1fa3565a7951cc415c634eb2b78dbdbee151d
CVE-2010-1087: kernel: NFS: Fix an Oops when truncating a file
Component: kernel
Severity: Important
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
Public date: 2010-02-19T00:00:00+00:00

The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 as they did not include the upstream commit 150030b7 that had introduced the problem. A future update in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 9f557cd8073104b39528794d44e129331ded649f
CVE-2010-1088: kernel: fix LOOKUP_FOLLOW on automount "symlinks"
Component: kernel
Severity: Moderate
Public date: 2010-02-19T00:00:00+00:00

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 as this issue only affects kernel version 2.6.18 and onwards. A future update in Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: ac278a9c505092dd82077a2446af8f9fc0d9c095
CVE-2010-1162: kernel: tty: release_one_tty() forgets to put pids
Component: kernel
Severity: Moderate
Public date: 2010-04-03T00:00:00+00:00

The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 as they did not include upstream commit ab521dc0 that introduced the problem. This issue was addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2010-0631.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.34
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 6da8d866d0d39e9509ff826660f6a86a6757c966