huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2014-6428: wireshark: SES dissector crash (wnpa-sec-2014-18)
Component: wireshark
Severity: Moderate
CWE: CWE-456 (Missing Initialization of a Variable)
Public date: 2014-09-07T00:00:00+00:00

The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 433a444d148f86f2562f804d25a57d00dc277cc0
CVE-2014-6429: wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)
Component: wireshark
Severity: Moderate
Public date: 2014-09-10T00:00:00+00:00

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not properly handle empty input data, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 47c592938ba9f0caeacc4c2ccadb370e72f293a2
CVE-2014-6430: wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)
Component: wireshark
Severity: Moderate
Public date: 2014-09-10T00:00:00+00:00

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 47c592938ba9f0caeacc4c2ccadb370e72f293a2
CVE-2014-6431: wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)
Component: wireshark
Severity: Moderate
Public date: 2014-09-10T00:00:00+00:00

Buffer overflow in the SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers writes of uncompressed bytes beyond the end of the output buffer.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 47c592938ba9f0caeacc4c2ccadb370e72f293a2
CVE-2014-6432: wireshark: DOS Sniffer file parser flaw (wnpa-sec-2014-19)
Component: wireshark
Severity: Moderate
Public date: 2014-09-10T00:00:00+00:00

The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: ssv0.9.0
Upstream repository: https://code.wireshark.org/review/wireshark.git
Upstream fix commit: 47c592938ba9f0caeacc4c2ccadb370e72f293a2
CVE-2014-7145: Kernel: cifs: NULL pointer dereference in SMB2_tcon
Component: Kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-08-17T00:00:00+00:00

A NULL pointer dereference flaw was found in the way the Linux kernel's Common Internet File System (CIFS) implementation handled mounting of file system shares. A remote attacker could use this flaw to crash a client system that would mount a file system share from a malicious server.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.17
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 18f39e7be0121317550d03e267e3ebd4dbfbb3ce
CVE-2014-7191: nodejs-qs: Denial-of-Service Memory Exhaustion
Component: nodejs-qs
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
Public date: 2014-08-06T00:00:00+00:00

The nodejs-qs module has the ability to create sparse arrays during parsing. By specifying a high index in a querystring parameter it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.

Statement: This package is not shipped with any versions of Red Hat Enterprise Linux.  Red Hat Software Collections Library components shipping in version 2.2 are affected.

Affected upstream versions: n/a
Upstream repository: https://github.com/raymondfeng/node-querystring
Upstream fix commit: 43a604b7847e56bba49d0ce3e222fe89569354d8
CVE-2014-7283: kernel: xfs: directory hash ordering denial of service
Component: kernel
Severity: Moderate
Public date: 2014-10-02T00:00:00+00:00

A denial of service flaw was found in the way the Linux kernel's XFS file system implementation ordered directory hashes under certain conditions. A local attacker could use this flaw to corrupt the file system by creating directories with colliding hash values, potentially resulting in a system crash.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Affected upstream versions: n/a
Fixed upstream versions: v3.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c88547a8119e3b581318ab65e9b72f27f23e641d
CVE-2014-7300: gnome-shell: lockscreen bypass with printscreen key
Component: gnome-shell
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
Public date: 2014-09-27T00:00:00+00:00

It was found that the Gnome shell did not disable the Print Screen key when the screen was locked. This could allow an attacker with physical access to a system with a locked screen to crash the screen-locking application by creating a large amount of screenshots.


Affected upstream versions: n/a
Fixed upstream versions: 3.14.1
Upstream repository: https://git.gnome.org/browse/gnome-shell
Upstream fix commit: a72dca361080ffc9f45ff90188a7cf013c3c4013
CVE-2014-7815: qemu: vnc: insufficient bits_per_pixel from the client sanitization
Component: qemu
Severity: Moderate
Public date: 2014-10-27T00:00:00+00:00

An uninitialized data structure use flaw was found in the way the set_pixel_format() function sanitized the value of bits_per_pixel. An attacker able to access a guest's VNC console could use this flaw to crash the guest.

Statement: This issue did not affect the kvm package as shipped with Red Hat Enterprise
Linux 5. Future qemu-kvm updates for Red Hat Enterprise Linux 6 and 7 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: e6908bfe8e07f2b452e78e677da1b45b1c0f6829
CVE-2014-7817: glibc: command execution in wordexp() with WRDE_NOCMD specified
Component: glibc
Severity: Moderate
CWE: CWE-440 (Expected Behavior Violation)
Public date: 2014-11-20T00:00:00+00:00

It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application.

Statement: This issue affects the version of glibc package as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact.

Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.21
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c
CVE-2014-7822: kernel: splice: lack of generic write checks
Component: kernel
Severity: Moderate
Public date: 2015-01-28T00:00:00+00:00

A flaw was found in the way the Linux kernel's splice() system call validated its parameters. On certain file systems, a local, unprivileged user could use this flaw to write past the maximum file size, and thus crash the system.

Statement: This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this flaw.

Affected upstream versions: n/a
Fixed upstream versions: v3.16
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8d0207652cbe27d1f962050737848e5ad4671958
CVE-2014-7825: kernel: insufficient syscall number validation in perf and ftrace subsystems
Component: kernel
Severity: Moderate
Public date: 2014-11-07T00:00:00+00:00

An out-of-bounds memory access flaw, CVE-2014-7825, was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system. Additionally, an out-of-bounds memory access flaw, CVE-2014-7826, was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5.

This issue does affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for
the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.18
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 086ba77a6db00ed858ff07451bedee197df868c9
CVE-2014-7826: kernel: insufficient syscall number validation in perf and ftrace subsystems
Component: kernel
Severity: Moderate
Public date: 2014-11-07T00:00:00+00:00

An out-of-bounds memory access flaw, CVE-2014-7825, was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system. Additionally, an out-of-bounds memory access flaw, CVE-2014-7826, was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.


Affected upstream versions: n/a
Fixed upstream versions: v3.18
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 086ba77a6db00ed858ff07451bedee197df868c9
CVE-2014-7840: qemu: insufficient parameter validation during ram load
Component: qemu
Severity: Moderate
CWE: CWE-822 (Untrusted Pointer Dereference)
Public date: 2014-11-12T00:00:00+00:00

It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 0be839a2701369f669532ea5884c15bead1c6e08
CVE-2014-7841: kernel: net: sctp: NULL pointer dereference in af->from_addr_param on malformed packet
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2014-11-10T00:00:00+00:00

A flaw was found in the way the Linux kernel's SCTP implementation validated INIT chunks when performing Address Configuration Change (ASCONF). A remote attacker could use this flaw to crash the system by sending a specially crafted SCTP packet to trigger a NULL pointer dereference on the system.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

This issue does affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.18
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: e40607cbe270a9e8360907cb1e62ddf0736e4864
CVE-2014-7842: kernel: kvm: reporting emulation failures to userspace
Component: kernel
Severity: Moderate
Public date: 2014-09-24T00:00:00+00:00

It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way.

Statement: This issue did not affect the kvm packages as shipped with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v3.18
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: a2b9e6c1a35afcc0973acb72e591c714e78885ff
CVE-2014-7933: chromium-browser: use-after-free in FFmpeg
Component: chromium-browser
Severity: Important
CWE: CWE-416 (Use After Free)
Public date: 2015-01-21T00:00:00+00:00

Use-after-free vulnerability in the matroska_read_seek function in libavformat/matroskadec.c in FFmpeg before 2.5.1, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data.


Affected upstream versions: n/a
Upstream repository: https://git.videolan.org/ffmpeg.git
Upstream fix commit: 490a3ebf36821b81f73e34ad3f554cb523dd2682
CVE-2014-7937: chromium-browser: use-after-free in FFmpeg
Component: chromium-browser
Severity: Important
CWE: CWE-416 (Use After Free)
Public date: 2015-01-21T00:00:00+00:00

Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data.


Affected upstream versions: n/a
Upstream repository: https://git.videolan.org/ffmpeg.git
Upstream fix commit: 8c50704ebf1777bee76772c4835d9760b3721057
CVE-2014-7970: Kernel: fs: VFS denial of service
Component: Kernel
Severity: Low
Public date: 2014-10-08T00:00:00+00:00

The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.18
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0d0826019e529f21c84687521d03f60cd241ca7d
CVE-2014-7975: Kernel: fs: umount denial of service
Component: Kernel
Severity: Low
Public date: 2014-10-08T00:00:00+00:00

The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb calls that change the root filesystem to read-only, which allows local users to cause a denial of service (loss of writability) by making certain unshare system calls, clearing the / MNT_LOCKED flag, and making an MNT_FORCE umount system call.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.18
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 0ef3a56b1c466629cd0bf482b09c7b0e5a085bb5
CVE-2014-8106: qemu: cirrus: insufficient blit region checks
Component: qemu
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
Public date: 2014-12-04T00:00:00+00:00

It was found that the Cirrus blit region checks were insufficient. A privileged guest user could use this flaw to write outside of VRAM-allocated buffer boundaries in the host's QEMU process address space with attacker-provided data.

Statement: This issue affects the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6, a future update may address this flaw.

This issue affects the kvm packages as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: bf25983345ca44aec3dd92c57142be45452bd38a
CVE-2014-8114: UberFire: Information disclosure and RCE via insecure file upload/download servlets
Component: UberFire
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
Public date: 2015-02-17T00:00:00+00:00

It was discovered that the default implementation of FileUploadServlet and FileDownloadServlet provided by the UberFire Framework did not restrict the paths to which a file could be written or read from. In applications using this framework and exposing these servlets, a remote attacker could gain access to information stored in files accessible to the application container process, or execute arbitrary code by uploading malicious content.


Affected upstream versions: n/a
Upstream repository: https://github.com/uberfire/uberfire
Upstream fix commit: 21ec50eb15
CVE-2014-8115: Workbench: Insufficient authorization constraints
Component: Workbench
Severity: Moderate
CWE: CWE-285 (Improper Authorization)
Public date: 2015-02-17T00:00:00+00:00

It was discovered that the default authorization constrains applied on servelets deployed in the KIE Workbench application were insufficient. A remote, authenticated user without sufficient privileges could use this flaw to upload or download arbitrary files, perform privileged actions that otherwise cannot be accessed, or perform other more complex attacks.

Statement: Red Hat JBoss BRMS 5 is now in Phase 3, Extended Life Support, of its life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Affected upstream versions: n/a
Upstream repository: https://github.com/droolsjbpm/kie-wb-distributions
Upstream fix commit: 90eed433d3
CVE-2014-8116: file: multiple denial of service issues (resource consumption)
Component: file
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
Public date: 2014-12-16T00:00:00+00:00

Multiple flaws were found in the way the File Information (fileinfo) extension parsed Executable and Linkable Format (ELF) files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of system resources.


Affected upstream versions: n/a
Fixed upstream versions: FILE5_21
Upstream repository: https://github.com/file/file
Upstream fix commit: d7cdad007c507e6c79f51f058dd77fab70ceb9f6
CVE-2014-8117: file: denial of service issue (resource consumption)
Component: file
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
Public date: 2014-12-16T00:00:00+00:00

A flaw was found in the way the File Information (fileinfo) extension parsed Executable and Linkable Format (ELF) files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of system resources.


Affected upstream versions: n/a
Fixed upstream versions: FILE5_21
Upstream repository: https://github.com/file/file
Upstream fix commit: 6f737ddfadb596d7d4a993f7ed2141ffd664a81c
CVE-2014-8122: Weld: Limited information disclosure via stale thread state
Component: Weld
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
Public date: 2014-12-04T00:00:00+00:00

It was discovered that under specific conditions the conversation state information stored in a thread-local variable in JBoss Weld was not sanitized correctly when the conversation ended. This could lead to a race condition that could potentially expose sensitive information from a previous conversation to the current conversation.


Affected upstream versions: n/a
Fixed upstream versions: 3.0.0.Final
Upstream repository: https://github.com/weld/core
Upstream fix commit: 29fd1107fd30579ad9bb23fae4dc3ba464205745
CVE-2014-8125: jBPM: BPMN2 file processing XXE in Process Execution
Component: jBPM
Severity: Moderate
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
Public date: 2014-12-22T00:00:00+00:00

It was discovered that the jBPM runtime performed expansion of external parameter entities while executing BPMN2 files. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XML eXternal Entity (XXE) attacks.

Statement: Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; and Red Hat JBoss Enterprise SOA Platform 4 and 5 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/

Affected upstream versions: n/a
Fixed upstream versions: 6.3.0.Final
Upstream repository: https://github.com/droolsjbpm/jbpm
Upstream fix commit: 713e8073ecf45623cfc5c918c5cbf700203f46e5
CVE-2014-8130: libtiff: divide by zero in the tiffdither tool
Component: libtiff
Severity: Low
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2014-12-07T00:00:00+00:00

The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.

Statement: Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw in libtiff.

Affected upstream versions: n/a
Fixed upstream versions: Release-v4-0-4
Upstream repository: https://github.com/vadz/libtiff
Upstream fix commit: 3c5eb8b1be544e41d2c336191bc4936300ad7543