huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-2324: git: path_name() integer truncation and overflow leading to buffer overflow
Component: git
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2016-03-06T00:00:00+00:00

An integer truncation flaw and an integer overflow flaw, both leading to a heap-based buffer overflow, were found in the way Git processed certain path information. A remote attacker could create a specially crafted Git repository that would cause a Git client or server to crash or, possibly, execute arbitrary code.

Statement: Red Hat Product Security has rated these issues as having Important security impact. For additional information, refer to the Red Hat Knowledgebase article: https://access.redhat.com/articles/2201201

Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://github.com/git/git
Upstream fix commit: de1e67d0703894cb6ea782e36abb63976ab07e60
CVE-2016-2342: quagga: VPNv4 NLRI parser memcpys to stack on unchecked length
Component: quagga
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-03-09T00:00:00+00:00

A stack-based buffer overflow flaw was found in the way the Quagga BGP routing daemon (bgpd) handled Labeled-VPN SAFI routes data. A remote attacker could use this flaw to crash the bgpd daemon resulting in denial of service.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/quagga.git
Upstream fix commit: a3bc7e9400b214a0f078fdb19596ba54214a1442
CVE-2016-2384: kernel: double-free in usb-audio triggered by invalid USB descriptor
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-02-14T00:00:00+00:00

A flaw was found in the USB-MIDI Linux kernel driver: a double-free error could be triggered for the 'umidi' object. An attacker with physical access to the system could use this flaw to escalate their privileges.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future updates for the respective releases may address the issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.5
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 07d86ca93db7e5cdf4743564d98292042ec21af7
CVE-2016-2510: bsh2: remote code execution via deserialization
Component: bsh2
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.4 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2016-02-22T00:00:00+00:00

A deserialization flaw allowing remote code execution was found in the BeanShell library. If BeanShell was on the classpath, it could permit code execution if another part of the application deserialized objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the BeanShell library.


Affected upstream versions: n/a
Upstream repository: https://github.com/beanshell/beanshell
Upstream fix commit: 7c68fde2d6fc65e362f20863d868c112a90a9b49
CVE-2016-2512: python-django: Malicious redirect and possible XSS attack via user-supplied redirect URLs containing basic auth
Component: python-django
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
Public date: 2016-03-01T00:00:00+00:00

An open-redirect flaw was found in the way Django's django.utils.http.is_safe_url() function filtered authentication URLs. An attacker able to trick a victim into visiting a crafted URL could use this flaw to redirect that victim to a malicious site.


Affected upstream versions: n/a
Fixed upstream versions: 1.10
Upstream repository: https://github.com/django/django
Upstream fix commit: c5544d289233f501917e25970c03ed444abbd4f0
CVE-2016-2513: python-django: User enumeration through timing difference on password hasher work factor upgrade
Component: python-django
Severity: Moderate
CWE: CWE-385 (Covert Timing Channel)
Public date: 2016-03-01T00:00:00+00:00

A timing attack flaw was found in the way Django's PBKDF2PasswordHasher performed password hashing. Passwords hashed with an older version of PBKDF2PasswordHasher used less hashing iterations, and thus allowed an attacker to enumerate existing users based on the time differences in the login requests.


Affected upstream versions: n/a
Fixed upstream versions: 1.10
Upstream repository: https://github.com/django/django
Upstream fix commit: 67b46ba7016da2d259c1ecc7d666d11f5e1cfaab
CVE-2016-2842: openssl: doapr_outch function does not verify that certain memory allocation succeeds
Component: openssl
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2016-03-03T00:00:00+00:00

Several flaws were found in the way BIO_*printf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application.


Affected upstream versions: n/a
Fixed upstream versions: OpenSSL_1_0_2g
Upstream repository: https://git.openssl.org/openssl.git
Upstream fix commit: 578b956fe741bf8e84055547b1e83c28dd902c73
CVE-2016-2847: kernel: pipe: limit the per-user amount of pages allocated in pipes
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2015-12-28T00:00:00+00:00

It is possible for a single process to cause an OOM condition by filling large pipes with data that are never read. A typical process filling 4096 pipes with 1 MB of data will use 4 GB of memory and there can be multiple such processes, up to a per-user-limit.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.5
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 759c01142a5d0f364a462346168a56de28a80f52
CVE-2016-2848: bind: assertion failure triggered by a packet with malformed options
Component: bind
Severity: Important
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-10-20T00:00:00+00:00

A denial of service flaw was found in the way BIND handled packets with malformed options. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS packet.


Affected upstream versions: n/a
Upstream repository: https://source.isc.org/cgi-bin/bind9.git
Upstream fix commit: 4adf97c32fcca7d00e5756607fd045f2aab9c3d4
CVE-2016-2857: Qemu: net: out of bounds read in net_checksum_calculate()
Component: Qemu
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.7 (CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L)
Public date: 2016-02-17T00:00:00+00:00

An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service).

Statement: This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 362786f14a753d8a5256ef97d7c10ed576d6572b
CVE-2016-3068: mercurial: command injection via git subrepository urls
Component: mercurial
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
Public date: 2016-03-29T00:00:00+00:00

It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a specially crafted URL could cause Mercurial to execute arbitrary code.


Affected upstream versions: n/a
Upstream repository: https://selenic.com/repo/hg-stable
Upstream fix commit: 34d43cb85de8
CVE-2016-3069: mercurial: convert extension command injection via git repository names
Component: mercurial
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
Public date: 2016-03-29T00:00:00+00:00

It was discovered that the Mercurial convert extension failed to sanitize special characters in Git repository names. A Git repository with a specially crafted name could cause Mercurial to execute arbitrary code when the Git repository was converted to a Mercurial repository.


Affected upstream versions: n/a
Upstream repository: https://selenic.com/repo/hg-stable
Upstream fix commit: b732e7f2aba4
CVE-2016-3070: kernel: Null pointer dereference in trace_writeback_dirty_page()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2016-05-10T00:00:00+00:00

A security flaw was found in the Linux kernel that an attempt to move page mapped by AIO ring buffer to the other node triggers NULL pointer dereference at trace_writeback_dirty_page(), because aio_fs_backing_dev_info.dev is 0.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future updates for the respective releases may address the issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 42cb14b110a5698ccf26ce59c4441722605a3743
CVE-2016-3074: php: Signedness vulnerability causing heap overflow in libgd
Component: php
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2016-04-22T00:00:00+00:00

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.


Affected upstream versions: n/a
Fixed upstream versions: gd-2.2.0
Upstream repository: https://github.com/libgd/libgd
Upstream fix commit: 2bb97f407c1145c850416a3bfbcc8cf124e68a19
CVE-2016-3075: glibc: Stack overflow in nss_dns_getnetbyname_r
Component: glibc
Severity: Low
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2016-03-29T00:00:00+00:00

A stack overflow vulnerability was found in _nss_dns_getnetbyname_r. On systems with nsswitch configured to include "networks: dns" with a privileged or network-facing service that would attempt to resolve user-provided network names, an attacker could provide an excessively long network name, resulting in stack corruption and code execution.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.24
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 317b199b4aff8cfa27f2302ab404d2bb5032b9a4
CVE-2016-3079: spacewalk-java: Multiple XSS issues in WebUI
Component: spacewalk-java
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
Public date: 2016-03-29T00:00:00+00:00

Multiple cross-site scripting (XSS) flaws were found in the way certain form data was handled in Red Hat Satellite. A user able to enter form data could use these flaws to perform XSS attacks against other Satellite users.


Affected upstream versions: n/a
Fixed upstream versions: gyp-0.1-0.6.1010svn.3
Upstream repository: https://github.com/spacewalkproject/spacewalk
Upstream fix commit: 7b9ff9ad
CVE-2016-3119: krb5: null pointer dereference in kadmin
Component: krb5
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2016-03-14T00:00:00+00:00

A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a null pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.15-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 08c642c09c38a9c6454ab43a9b53b2a89b9eef99
CVE-2016-3120: krb5: S4U2Self KDC crash when anon is restricted
Component: krb5
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-19T00:00:00+00:00

A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a null pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.15-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7
CVE-2016-3134: kernel: netfilter: missing bounds check in ipt_entry structure
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.4 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H)
Public date: 2016-03-10T00:00:00+00:00

A security flaw was found in the Linux kernel in the mark_source_chains() function in "net/ipv4/netfilter/ip_tables.c". It is possible for a user-supplied "ipt_entry" structure to have a large "next_offset" field. This field is not bounds checked prior to writing to a counter value at the supplied offset.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6. This issue is not currently planned to be addressed in future updates, as user namespaces which the flaw affects are not supported in these products. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 54d83fc74aa9ec72794373cb47432c5f7fb1a309
CVE-2016-3141: php: Use after free in WDDX Deserialize when processing XML data
Component: php
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2016-02-14T00:00:00+00:00

Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.33
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: b1bd4119bcafab6f9a8f84d92cd65eec3afeface
CVE-2016-3142: php: Out-of-bounds read in phar_parse_zipfile()
Component: php
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2016-02-02T00:00:00+00:00

The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.33
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: a6fdc5bb27b20d889de0cd29318b3968aabb57bd
CVE-2016-3156: kernel: ipv4: denial of service when destroying a network interface
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
Public date: 2016-03-15T00:00:00+00:00

A security flaw was found in the Linux kernel's networking subsystem that destroying the network interface with huge number of ipv4 addresses assigned keeps "rtnl_lock" spinlock for a very long time (up to hour). This blocks many network-related operations, including creation of new incoming ssh connections.

The problem is especially important for containers, as the container owner has enough permissions to trigger this and block a network access on a whole host, outside the container.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates, as the Linux containers which the flaw affects are not supported in these products. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fbd40ea0180a2d328c5adc61414dc8bab9335ce2
CVE-2016-3190: cairo: out of bounds read in fill_xrgb32_lerp_opaque_spans
Component: cairo
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
Public date: 2016-03-10T00:00:00+00:00

The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/cairo/patch/src/cairo-image-compositor.c
Upstream fix commit: 5c82d91a5e15d29b1489dcb413b24ee7fdf59934
CVE-2016-3672: kernel: unlimiting the stack disables ASLR
Component: kernel
Severity: Low
CWE: CWE-341 (Predictable from Observable State)
Public date: 2016-04-06T00:00:00+00:00

A weakness was found in the Linux ASLR implementation. Any user able to running 32-bit applications in a x86 machine can disable ASLR by setting the RLIMIT_STACK resource to unlimited.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8b8addf891de8a00e4d39fc32f93f7c5eb8feceb
CVE-2016-3693: foreman: inspect in a provisioning template exposes sensitive controller information
Component: foreman
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-04-14T00:00:00+00:00

A flaw was found in the provisioning template handling in foreman. An attacker, with permissions to create templates, can cause internal Rails information to be displayed when it is processed, resulting in potentially sensitive information being disclosed.


Affected upstream versions: n/a
Fixed upstream versions: 1.12.0
Upstream repository: https://github.com/theforeman/foreman
Upstream fix commit: 82f9b93c54f72c5814df6bab7fad057eab65b2f2
CVE-2016-3697: docker: privilege escalation via confusion of usernames and UIDs
Component: docker
Severity: Moderate
Public date: 2016-04-22T00:00:00+00:00

It was found that Docker would launch containers under the specified UID instead of a username. An attacker able to launch a container could use this flaw to escalate their privileges to root within the launched container.


Affected upstream versions: n/a
Fixed upstream versions: v0.1.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 69af385de62ea68e2e608335cffbb0f4aa3db091
CVE-2016-3698: libndp: denial of service due to insufficient validation of source of NDP messages
Component: libndp
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
Public date: 2016-05-17T00:00:00+00:00

It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol (NDP) messages. An attacker on a non-local network could use this flaw to advertise a node as a router, allowing them to perform man-in-the-middle attacks on a connecting client, or disrupt the network connectivity of that client.


Affected upstream versions: n/a
Fixed upstream versions: v1.6
Upstream repository: https://github.com/jpirko/libndp
Upstream fix commit: a4892df306e0532487f1634ba6d4c6d4bb381c7f
CVE-2016-3699: kernel: ACPI table override allowed when securelevel is enabled
Component: kernel
Severity: Low
CWE: CWE-358 (Improperly Implemented Security Check for Standard)
Public date: 2016-03-05T00:00:00+00:00

The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Upstream repository: https://github.com/mjg59/linux
Upstream fix commit: a4a5ed2835e8ea042868b7401dced3f517cafa76
CVE-2016-3728: foreman: Missing input validation in Smart Proxy allows RCE via TFTP file variant parameter
Component: foreman
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
Public date: 2016-05-05T00:00:00+00:00

It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user.


Affected upstream versions: n/a
Fixed upstream versions: 1.12.0
Upstream repository: https://github.com/theforeman/smart-proxy
Upstream fix commit: eef532aa668d656b9d61d9c6edf7c2505f3f43c7