vdanen/rhvex-cve huggingface dataset:
CVE-2014-1343 (Moderate severity, published 2015-01-25)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-1713 (Moderate severity, published 2015-01-25)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in the AttributeSetter function in bindings/templates/attributes.cpp in the bindings in Blink, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the document.location value.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-5029 (Moderate severity, published 2014-07-21)
CVSS score: 5 (AV:L/AC:M/Au:S/C:C/I:P/A:N)
CWE: CWE-59
Description: It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. A local user with the 'lp' group privileges could use this flaw to read the contents of arbitrary files on the system or, potentially, escalate their privileges on the system.
Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle, https://access.redhat.com/support/policy/updates/errata/
CVE-2014-1590 (Low severity, published 2014-12-01)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-20
Description: The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
CVE-2014-4268 (Moderate severity, published 2014-07-14)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Description: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5 allows remote attackers to affect confidentiality via unknown vectors related to Swing.
CVE-2014-7852 (Moderate severity, published 2014-12-08)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CWE: CWE-79
Description: It was found that RichFaces accepted arbitrary strings included in a URL and returned them unencoded in a CSS file. A remote attacker could use this flaw to perform cross-site scripting (XSS) attacks against a user running a RichFaces application.
CVE-2014-4287 (Moderate severity, published 2014-10-14)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:CHARACTER SETS.
CVE-2014-8119 (Moderate severity, published 2015-03-29)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-476
Description: A denial of service flaw was found in netcf. A specially crafted interface name could cause an application using netcf (such as the libvirt daemon) to crash.
CVE-2014-0483 (Moderate severity, published 2014-08-19)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N)
Description: The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.
CVE-2014-1338 (Moderate severity, published 2015-01-25)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-05-21-1.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-9358 (Low severity, published 2014-12-10)
CVSS score: 7.1 (AV:N/AC:M/Au:N/C:N/I:C/A:N)
Description: Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
CVE-2014-1292 (Moderate severity, published 2015-01-25)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit, as used in Apple iOS before 7.1 and Apple TV before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1289, CVE-2014-1290, CVE-2014-1291, CVE-2014-1293, and CVE-2014-1294.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-3610 (Important severity, published 2014-10-20)
CVSS score: 5.5 (AV:A/AC:L/Au:S/C:N/I:N/A:C)
CWE: CWE-248
Description: It was found that KVM's Write to Model Specific Register (WRMSR) instruction emulation would write non-canonical values passed in by the guest to certain MSRs in the host's context. A privileged guest user could use this flaw to crash the host.
Statement: This issue does not affect Linux kernel packages as shipped with Red Hat Enterprise Linux 6 and 7. Future kvm package updates for Red Hat Enterprise Linux 5 may address this issue.
CVE-2014-0196 (Important severity, published 2014-04-30)
CVSS score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Description: The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Statement: This issue did not affect the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.

This issue affected the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 prior to version kernel-2.6.32-358.6.1.el6, released via RHSA-2013:0744 (https://rhn.redhat.com/errata/RHSA-2013-0744.html). That update added a backport of the upstream commit c56a00a165, which avoided this issue.

This flaw requires local system access to be exploited. We are currently not aware of any working exploit for Red Hat Enterprise Linux 6 or Red Hat Enterprise MRG 2.
CVE-2014-2451 (Low severity, published 2014-04-14)
CVSS score: 3.5 (AV:N/AC:M/Au:S/C:N/I:N/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.6.15 and earlier allows remote authenticated users to affect availability via unknown vectors related to Privileges.
CVE-2014-7203 (Moderate severity, published 2014-09-19)
CVSS score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-323
Description: libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.
Statement: This issue did not affect the versions of zeromq as shipped with Inktank Ceph Enterprise 1.2 and 1.3.
CVE-2014-7829 (Low severity, published 2014-11-16)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-200
Description: Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
CVE-2014-1504 (Low severity, published 2014-03-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Description: The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
CVE-2014-3493 (Low severity, published 2014-06-22)
CVSS score: 2.7 (AV:A/AC:L/Au:S/C:N/I:N/A:P)
CWE: CWE-393
Description: It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash.
Statement: This issue affects the versions of samba3x as shipped with Red Hat Enterprise Linux 5. This issue affects the versions of samba and samba4 as shipped with Red Hat Enterprise Linux 6. This issue affects the versions of samba as shipped with Red Hat Enterprise Linux 7. This issue did not affect the versions of samba as shipped with Red Hat Enterprise Linux 5.
CVE-2014-9837 (Moderate severity, published 2014-12-23)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file.
CVE-2014-2282 (Moderate severity, published 2014-03-06)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.
Statement: Not vulnerable. This issue does not affect the version of wireshark package as shipped with Red Hat Enterprise Linux 5 and 6.
CVE-2014-0250 (Moderate severity, published 2014-05-27)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-190
Description: Multiple integer overflows in client/X11/xf_graphics.c in FreeRDP allow remote attackers to have an unspecified impact via the width and height to the (1) xf_Pointer_New or (2) xf_Bitmap_Decompress function, which causes an incorrect amount of memory to be allocated.
CVE-2014-1912 (Moderate severity, published 2014-01-13)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-120
Description: It was discovered that the socket.recvfrom_into() function failed to check the size of the supplied buffer. This could lead to a buffer overflow when the function was called with an insufficiently sized buffer.
Statement: This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 as they did not include the vulnerable socket.recvfrom_into() function.  This issue was also corrected in the version of python shipped with Red Hat Enterprise Linux 7.0 prior to release.

The Red Hat Security Response Team has rated this issue as having Moderate security impact. A future update may address this issue in Red Hat Software Collections. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2014-3186 (Moderate severity, published 2014-08-26)
CVSS score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
CWE: CWE-787
Description: A buffer overflow flaw was found in the way the Minibox PicoLCD driver handled Human Interface Device (HID) reports with an invalid size. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system.
Statement: This issue does not affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the version of the kernel package as shipped with
Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise
Linux 7 may address this issue.
CVE-2014-9421 (Moderate severity, published 2015-02-02)
CVSS score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CWE: CWE-416
Description: A double-free flaw was found in the way MIT Kerberos handled invalid External Data Representation (XDR) data. An authenticated user could use this flaw to crash the MIT Kerberos administration server (kadmind), or other applications using Kerberos libraries, using specially crafted XDR packets.
Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2014-6500 (Important severity, published 2014-10-14)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491.
Statement: This issue did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 5, 6, and 7, as they use system OpenSSL library rather than yaSSL.
CVE-2014-3702 (Moderate severity, published 2015-03-16)
CVSS score: 6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P)
CWE: CWE-22
Description: Directory traversal vulnerability in eNovance eDeploy allows remote attackers to create arbitrary directories and files and consequently cause a denial of service (resource consumption) via a .. (dot dot) the session parameter.
Statement: Red Hat does not currently ship eNovance edeploy in a product form and as such this issue has been filed upstream.
CVE-2014-0084 (Low severity, published 2014-02-13)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-400
Description: Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
CVE-2014-0591 (Moderate severity, published 2014-01-12)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Description: A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash.
Statement: This issue does not affect the version of bind and bind97 as shipped with Red Hat Enterprise Linux 5. For a technical explanation please see https://bugzilla.redhat.com/show_bug.cgi?id=1051717#c25
CVE-2014-3647 (Moderate severity, published 2014-10-20)
CVSS score: 4.4 (AV:L/AC:M/Au:S/C:N/I:N/A:C)
CWE: CWE-248
Description: A flaw was found in the way the Linux kernel's KVM subsystem handled non-canonical addresses when emulating instructions that change the RIP (for example, branches or calls). A guest user with access to an I/O or MMIO region could use this flaw to crash the guest.
Statement: This issue does affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. Future kernel updates may address this issue.

This issue does affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6. The risks associated with fixing this bug are greater than its security impact. This issue is not currently planned to be addressed in future kernel updates for Red Hat Enterprise Linux 6.

This issue does affect the kvm packages as shipped with Red Hat Enterprise Linux 5.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2014-9163 (Critical severity, published 2014-12-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.
CVE-2014-1553 (Critical severity, published 2014-09-02)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.
CVE-2014-3581 (Low severity, published 2014-09-07)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled.
Statement: This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5 and 6, JBoss Enterprise Web Server 1 and 2, and JBoss Application Platform 6.
CVE-2014-4244 (Moderate severity, published 2014-07-14)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Description: Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.
CVE-2014-8637 (Moderate severity, published 2015-01-14)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-125
Description: Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5, 6 and 7.
CVE-2014-0207 (Moderate severity, published 2014-06-26)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.
Statement: This issue does not affect the file, php, or php53 packages in Red Hat Enterprise Linux 5 and 6. This issue affects the file package in Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update my address this flaw.
CVE-2014-8158 (Moderate severity, published 2015-01-20)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-770
Description: An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.
CVE-2014-0092 (Important severity, published 2014-03-02)
CVSS score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CWE: CWE-295
Description: lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVE-2014-0138 (Moderate severity, published 2014-03-25)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.
Statement: This issue affects the version of curl as shipped with Red Hat Enterprise Linux 5 and 7. The Red Hat Security Response Team has rated this issue as having Moderate security impact, a future update may address this flaw.
CVE-2014-9749 (Moderate severity, published 2015-01-27)
CVSS score: 4 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
Description: Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce replay vulnerability."
CVE-2014-1729 (Moderate severity, published 2014-02-26)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple unspecified vulnerabilities in Google V8 before 3.24.35.22, as used in Google Chrome before 34.0.1847.116, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2014-3651 (Low severity, published 2014-10-20)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-400
Description: It was discovered that by requesting a large enough image size for a generated QR code in JBoss KeyCloak, a remote attacker could cause uncontrolled resource consumption leading to denial of service for legitimate users.
Statement: This issue does not affect any supported Red Hat products.
CVE-2014-2410 (Critical severity, published 2014-04-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Oracle Java SE 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
CVE-2014-0587 (Critical severity, published 2014-12-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9164.
CVE-2014-1545 (Moderate severity, published 2014-06-09)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-787
Description: An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox.
CVE-2014-3578 (Moderate severity, published 2014-09-04)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-22
Description: A directory traversal flaw was found in the Spring Framework. A remote attacker could use this flaw to access arbitrary files on a server, and bypassing security restrictions that are otherwise in place.
CVE-2014-3981 (Low severity, published 2014-06-03)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
CWE: CWE-377
Description: acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.
Statement: This issue did not affect binary PHP packages as shipped with Red Hat Enterprise Linux and Red Hat Software Collections.