huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2017-6214: kernel: ipv4/tcp: Infinite loop in tcp_splice_read()
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-02-07T00:00:00+00:00

A flaw was found in the Linux kernel's handling of packets with the URG flag. Applications using the splice() and tcp_splice_read() functionality could allow a remote attacker to force the kernel to enter a condition in which it could loop indefinitely.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.10
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ccf7abb93af09ad0868ae9033d1ca8108bdaec82
CVE-2017-6413: mod_auth_openidc: OIDC_CLAIM and OIDCAuthNHeader not skipped in an "AuthType oauth20" configuration
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-02-20T00:00:00+00:00

It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths. A remote attacker could potentially use this flaw to bypass authentication and access sensitive information by sending crafted HTTP requests.


Affected upstream versions: n/a
Fixed upstream versions: v2.1.6
Upstream repository: https://github.com/pingidentity/mod_auth_openidc
Upstream fix commit: 21e3728a825c41ab41efa75e664108051bb9665e
CVE-2017-6414: Qemu: libcacard: host memory leakage while creating new APDU
Component: Qemu
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2017-02-21T00:00:00+00:00

Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.


Affected upstream versions: n/a
Fixed upstream versions: v2.5.3
Upstream repository: https://cgit.freedesktop.org/spice/libcacard
Upstream fix commit: 9113dc6a303604a2d9812ac70c17d076ef11886c
CVE-2017-7184: kernel: Out-of-bounds heap access in xfrm
Component: kernel
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-03-29T00:00:00+00:00

Out-of-bounds kernel heap access vulnerability was found in xfrm, kernel's IP framework for transforming packets. An error dealing with netlink messages from an unprivileged user leads to arbitrary read/write and privilege escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. In a default or common use of Red Hat Enterprise Linux 7 and MRG-2 this issue does not allow an unprivileged local or remote user to elevate their privileges on the system.

In order to exploit this issue the attacker needs CAP_NET_ADMIN capability, which needs to be granted especially by the administrator to the attacker's process. This in turn requires granting CAP_NET_ADMIN capability to the process' binary and/or attacker's account.

Another possibility to obtain CAP_NET_ADMIN capability in Red Hat Enterprise Linux 7 for an attacker is running a process inside a user+network namespace with mapped root privileges inside the namespace. Since Red Hat Enterprise Linux 7 does not have unprivileged user namespaces enabled by default, local or remote unprivileged users also cannot abuse namespaces to grant this capability to themselves and elevate their privileges.

Given the severity of this issue, future Linux kernel updates for the Red Hat Enterprise Linux 7 and MRG-2 products are planned to address it.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 677e806da4d916052585301785d847c3b3e6186a
CVE-2017-7187: kernel: scsi: Stack-based buffer overflow in sg_ioctl function
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-03-16T00:00:00+00:00

The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impacts via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, as the change that introduced the flaw is not present in the code of these products. 

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2.  Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
Upstream fix commit: bf33f87dd04c371ea33feb821b60d63d754e3124
CVE-2017-7395: tigervnc: Integer overflow in SMsgReader::readClientCutText
Component: tigervnc
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-03-27T00:00:00+00:00

An integer overflow flaw was found in the way TigerVNC handled ClientCutText messages. A remote, authenticated attacker could use this flaw to make Xvnc crash by sending specially crafted ClientCutText messages, resulting in denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v1.7.90
Upstream repository: https://github.com/TigerVNC/tigervnc
Upstream fix commit: bf3bdac082978ca32895a4b6a123016094905689
CVE-2017-7396: tigervnc: SecurityServer and ClientServer memory leaks
Component: tigervnc
Severity: Low
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-03-27T00:00:00+00:00

A memory leak flaw was found in the way TigerVNC handled client connections. A remote unauthenticated attacker could repeatedly send connection requests to the Xvnc server, causing it to consume large amounts of memory resources over time, and ultimately leading to a denial of service due to memory exhaustion.


Affected upstream versions: n/a
Fixed upstream versions: v1.7.90
Upstream repository: https://github.com/TigerVNC/tigervnc
Upstream fix commit: dccb5f7d776e93863ae10bbff56a45c523c6eeb0
CVE-2017-7407: curl: --write-out out of bounds read
Component: curl
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.4 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2017-04-04T00:00:00+00:00

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

Statement: This flaw did not affect Red Hat Enterprise Linux 8 and Red Hat Software Collections 3, as they already included the fixed version of the `curl` package.

Affected upstream versions: n/a
Fixed upstream versions: curl-7_54_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: 1890d59905414ab84a35892b2e45833654aa5c13
CVE-2017-7472: kernel: keyctl_set_reqkey_keyring() leaks thread keyrings
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-04-01T00:00:00+00:00

A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in this product.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: Linux kernel before 4.10.13
Fixed upstream versions: v4.11
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c9f838d104fed6f2f61d68164712e3204bf5271b
CVE-2017-7477: kernel: net: Heap overflow in skb_to_sgvec in macsec.c
Component: kernel
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-04-24T00:00:00+00:00

A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 starting with the version kernel-3.10.0-514.el7, that is with Red Hat Enterprise Linux 7.3 GA. Prior Red Hat Enterprise Linux 7 kernel versions are not affected.

In order to exploit this issue, the system needs to be manually configured by privileged user. The default Red Hat Enterprise Linux 7 configuration is not vulnerable.

Affected upstream versions: Linux kernel
Fixed upstream versions: v4.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
Upstream fix commit: 4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee
CVE-2017-7481: ansible: Security issue with lookup return not tainting the jinja2 environment
Component: ansible
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)
Public date: 2017-05-09T00:00:00+00:00

An input validation flaw was found in Ansible, where it fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.


Affected upstream versions: ansible 2.3.1.0, ansible 2.4.0.0
Fixed upstream versions: v2.4.0.0-1
Upstream repository: https://github.com/ansible/ansible
Upstream fix commit: ed56f51f185a1ffd7ea57130d260098686fcc7c2
CVE-2017-7482: kernel: net/rxrpc: overflow in decoding of krb5 principal
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2017-06-26T00:00:00+00:00

Keberos 5 tickets being decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6 and 7 as the module is not enabled on these systems.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise MRG-2.  Future Linux kernel updates for the respective releases may address this issue.

Affected upstream versions: 4.12
Fixed upstream versions: v4.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5f2f97656ada8d811d3c1bef503ced266fcd53a0
CVE-2017-7495: kernel: ext4: power failure during write(2) causes on-disk information leak
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-05-12T00:00:00+00:00

A vulnerability was found in the Linux kernel where filesystems mounted with data=ordered mode may allow an attacker to read stale data from recently allocated blocks in new files after a system 'reset' by abusing ext4 mechanics of delayed allocation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2.  Future Linux kernel updates for the respective releases may address this issue.
fs

Affected upstream versions: Linux kernel before 4.6.2
Fixed upstream versions: v4.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 06bd3c36a733ac27962fea7d6f47168841376824
CVE-2017-7502: nss: Null pointer dereference when handling empty SSLv2 messages
Component: nss
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-05-30T00:00:00+00:00

A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library.


Affected upstream versions: since 3.24.0
Upstream repository: https://hg.mozilla.org/projects/nss
Upstream fix commit: 55ea60effd0d
CVE-2017-7533: kernel: a race between inotify_handle_event() and sys_rename()
Component: kernel
Severity: Important
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2017-08-03T00:00:00+00:00

A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted with attacker-controlled data, which may lead to the privilege escalation.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, 7.0 and 7.1 as the code with the flaw is not present in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 7.2 and newer and Red Hat Enterprise MRG 2. Future kernel updates for these products may address this issue.

Affected upstream versions: Linux kernel through 4.12.4
Fixed upstream versions: v4.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 49d31c2f389acfe83417083e1208422b4091cd9e
CVE-2017-7537: pki-core: mock CMC authentication plugin with hardcoded secret enabled by default
Component: pki-core
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2017-07-21T00:00:00+00:00

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.


Affected upstream versions: 10.6.4
Fixed upstream versions: v10.5.0
Upstream repository: https://github.com/dogtagpki/pki
Upstream fix commit: 876d13c6d20e7e1235b9
CVE-2017-7539: Qemu: qemu-nbd crashes due to undefined I/O coroutine
Component: Qemu
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-06-02T00:00:00+00:00

An assertion-failure flaw was found in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.


Affected upstream versions: 2.10.1
Fixed upstream versions: v2.10.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 2b0bbc4f8809c972bad134bc1a2570dbb01dea0b
CVE-2017-7541: kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx()
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2017-07-17T00:00:00+00:00

Kernel memory corruption due to a buffer overflow was found in brcmf_cfg80211_mgmt_tx() function in Linux kernels from v3.9-rc1 to v4.13-rc1. The vulnerability can be triggered by sending a crafted NL80211_CMD_FRAME packet via netlink. This flaw is unlikely to be triggered remotely as certain userspace code is needed for this. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.

Statement: This issue does not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for these products may address this issue.

Affected upstream versions: Linux kernel before 4.12.3
Fixed upstream versions: v4.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8f44c9a41386729fea410e688959ddaa9d51be7c
CVE-2017-7542: kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
Component: kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-07-19T00:00:00+00:00

An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and does not qualify for inclusion as part of the Red Hat Enterprise Linux 5 lifecycle. For more information on the lifecycle see https://access.redhat.com/support/policy/updates/errata

Affected upstream versions: Linux kernel versions up to and including 4.12
Fixed upstream versions: v4.13
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 6399f1fae4ec29fab5ec76070435555e256ca3a6
CVE-2017-7545: jbpmmigration: XXE vulnerability in XmlUtils
Component: jbpmmigration
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-11-30T16:00:00+00:00

It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.


Affected upstream versions: 6.5
Upstream repository: https://github.com/kiegroup/jbpm-designer
Upstream fix commit: a143f3b92a6a5a527d929d68c02a0c5d914ab81d
CVE-2017-7562: krb5: Authentication bypass by improper validation of certificate EKU and SAN
Component: krb5
Severity: Moderate
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2017-08-25T00:00:00+00:00

An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.


Affected upstream versions: 1.16.1
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: 50fe4074f188c2d4da0c421e96553acea8378db2
CVE-2017-7616: kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c
Component: kernel
Severity: Moderate
CWE: CWE-390 (Detection of Error Condition Without Action)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2017-04-08T00:00:00+00:00

Incorrect error handling in the set_mempolicy() and mbind() compat syscalls in 'mm/mempolicy.c' in the Linux kernel allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 on ppc64 and ppc64le platforms. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 and 7 on ppc64 and ppc64le platforms. Future Linux kernel updates for the respective releases might address this issue.

Only ppc64 and ppc64le hardware platforms are vulnerable. The Linux kernel packages for other platforms which Red Hat ships (i386, x86_64, s390x) are not vulnerable to this security flaw.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux MRG-2 as this product is shipped for x86_64 hardware platform only.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: cf01fb9985e8deb25ccf0ea54d916b8871ae0e62
CVE-2017-7645: kernel: nfsd: Incorrect handling of long RPC replies
Component: kernel
Severity: Important
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2017-04-14T00:00:00+00:00

The NFS2/3 RPC client could send long arguments to the NFS server. These encoded arguments are stored in an array of memory pages, and accessed using pointer variables. Arbitrarily long arguments could make these pointers point outside the array and cause an out-of-bounds memory access. A remote user or program could use this flaw to crash the kernel, resulting in denial of service.

Statement: This issue affects the versions of the Linux kernel as shipped with
Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel
updates for Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2 may
address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.11
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: e6838a29ecb484c97e4efef9429643b9851fba6e
CVE-2017-7718: Qemu: display: cirrus: OOB read access issue
Component: Qemu
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4 (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L)
Public date: 2017-03-14T00:00:00+00:00

An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v2.9.0
Upstream repository: https://git.qemu-project.org/qemu.git
Upstream fix commit: 215902d7b6fb50c6fc216fc74f770858278ed904