vdanen/rhvex-cve huggingface dataset:
CVE-2010-0430 (Important severity, published 2010-03-29)
CVSS score: 6.6 (AV:L/AC:M/Au:S/C:C/I:C/A:C)
Description: libspice, as used in QEMU-KVM in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 and possibly other products, allows guest OS users to read from or write to arbitrary QEMU memory by modifying the address that is used by Cairo for memory mappings.
Statement: The CVE-2010-0430 issue was fixed in the kvm packages for Red Hat Enterprise Linux 5 via RHSA-2010:0271, and fixed in the rhev-hypervisor package via RHSA-2010:0476. This CVE was not disclosed at the time the errata were released; therefore, it was not mentioned in them.
CVE-2010-4473 (Important severity, published 2011-02-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound and unspecified APIs, a different vulnerability than CVE-2010-4454 and CVE-2010-4462.
CVE-2010-0826 (Moderate severity, published 2010-03-31)
CVSS score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)
Description: The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.
CVE-2010-3709 (Low severity, published 2010-10-18)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.
Statement: This issue did not affect the version of PHP as shipped with Red Hat Enterprise Linux 3, 4 or 5.
CVE-2010-2548 (Moderate severity, published 2010-07-27)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Description: IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.
Statement: This issue does not affect the version of the java-1.6.0-openjdk package, as
shipped with Red Hat Enterprise Linux 5.
CVE-2010-0298 (Important severity, published 2010-02-08)
CVSS score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Description: The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.
CVE-2010-1870 (Moderate severity, published 2010-07-24)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Description: The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the "#" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.
Statement: A previous statement by Red Hat related to this CVE, prior to August 2019, said that Apache Struts 2 is not included in any Red Hat products. This earlier statement was incorrect. While Struts 2 is not actively compiled, shipped, used, or enabled in any Red Hat provided final products, and does not cause any vulnerability in the product, struts2-core jars have been included in some products' source code packages. The inclusion was part of an import of the Google Guice repository, which includes struts2-core. Customers that build artefacts from our source code could be at risk. Red Hat will remove these artefacts from source code in future releases.

The products that included the Struts 2 artefacts in their source jars:
Fuse Service Works 6.0.0
Single Sign On 7.3.0+

If you have used the source package from one of these products to build artefacts on your system, you should do the following to remove potentially affected jars:
1. Run 'find . -name struts2*.jar' under the source location
2. Remove any files found
This will not affect the product, as the jar is included with the source of google-guice, but no functionality requiring struts2 is implemented.
CVE-2010-1173 (Important severity, published 2010-04-28)
CVSS score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)
CWE: CWE-119
Description: The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
Statement: Red Hat is aware of this issue and is tracking it via the following bug:
https://bugzilla.redhat.com/CVE-2010-1173.

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for SCTP. Future kernel updates in Red Hat Enterprise Linux 4, 5 and Red Hat Enterprise MRG may address this flaw.

For more information, please see http://kbase.redhat.com/faq/docs/DOC-31052.
CVE-2010-4664 (Moderate severity, published 2010-06-02)
CVSS score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
Description: In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session.
CVE-2010-0277 (Moderate severity, published 2009-12-26)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.6, including 2.6.4, and Adium 1.3.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed MSNSLP INVITE request in an SLP message, a different issue than CVE-2010-0013.
Statement: We currently have no plans to fix this flaw in Red Hat Enterprise Linux 3 as the MSN protocol support in the provided version of Pidgin (1.5.1) is out-dated and no longer supported by MSN servers. There are no plans to backport MSN protocol changes for that version of Pidgin.
CVE-2010-3772 (Critical severity, published 2010-12-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, does not properly calculate index values for certain child content in a XUL tree, which allows remote attackers to execute arbitrary code via vectors involving a DIV element within a treechildren element.
CVE-2010-2163 (Critical severity, published 2010-06-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple unspecified vulnerabilities in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unknown vectors.
CVE-2010-2499 (Important severity, published 2010-06-08)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.
CVE-2010-3119 (Moderate severity, published 2010-08-18)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Google Chrome before 5.0.375.127 and webkitgtk before 1.2.6 do not properly support the Ruby language, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVE-2010-3549 (Important severity, published 2010-10-11)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.
CVE-2010-4263 (Important severity, published 2010-03-18)
CVSS score: 5.7 (AV:A/AC:M/Au:N/C:N/I:N/A:C)
Description: The igb_receive_skb function in drivers/net/igb/igb_main.c in the Intel Gigabit Ethernet (aka igb) subsystem in the Linux kernel before 2.6.34, when Single Root I/O Virtualization (SR-IOV) and promiscuous mode are enabled but no VLANs are registered, allows remote attackers to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via a VLAN tagged frame.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG as they did not include support for PCI I/O Virtualization (IOV). Future updates in Red Hat Enterprise Linux 5 and 6 may address this flaw.
CVE-2010-1431 (Moderate severity, published 2010-04-20)
CVSS score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
Description: SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.
CVE-2010-1974 (None severity, published 2010-05-07)
CVSS score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
Description: No description is available for this CVE.
Statement: This flaw was found to be a duplicate of CVE-2010-1168. Please see https://access.redhat.com/security/cve/CVE-2010-1168 for information about affected products and security errata.
CVE-2010-3699 (Moderate severity, published 2010-11-23)
CVSS score: 2.7 (AV:A/AC:L/Au:S/C:N/I:N/A:P)
Description: The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.
CVE-2010-3676 (Low severity, published 2010-07-08)
CVSS score: 2.7 (AV:A/AC:L/Au:S/C:N/I:N/A:P)
Description: storage/innobase/dict/dict0crea.c in mysqld in Oracle MySQL 5.1 before 5.1.49 allows remote authenticated users to cause a denial of service (assertion failure) by modifying the (1) innodb_file_format or (2) innodb_file_per_table configuration parameters for the InnoDB storage engine, then executing a DDL statement.
Statement: Not vulnerable. This issue did not affect the versions of mysql package
as shipped with Red Hat Enterprise Linux 3, 4, 5, or 6.
CVE-2010-1866 (Moderate severity, published 2010-05-01)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.
Statement: Not vulnerable. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 3, 4, or 5, and Red Hat Application Stack v2.
CVE-2010-2175 (Critical severity, published 2010-06-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166, CVE-2010-2171, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, CVE-2010-2187, and CVE-2010-2188.
CVE-2010-1759 (Critical severity, published 2010-06-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.
CVE-2010-3621 (Critical severity, published 2010-10-04)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3622, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
CVE-2010-4469 (Important severity, published 2011-02-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot.  NOTE: the previous information was obtained from the February 2011 CPU.  Oracle has not commented on claims from a downstream vendor that this issue is heap corruption related to the Verifier and "backward jsrs."
CVE-2010-3656 (Low severity, published 2010-10-04)
CVSS score: 0 (AV:N/AC:M/Au:N/C:N/I:N/A:N)
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to cause a denial of service via unknown vectors, a different vulnerability than CVE-2010-3657.
CVE-2010-0095 (Important severity, published 2010-03-29)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0093.
CVE-2010-4255 (Moderate severity, published 2010-11-28)
CVSS score: 6.1 (AV:A/AC:L/Au:N/C:N/I:N/A:C)
Description: The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.
CVE-2010-0187 (Low severity, published 2010-02-10)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: Adobe Flash Player before 10.0.45.2 and Adobe AIR before 1.5.3.9130 allow remote attackers to cause a denial of service (application crash) via a modified SWF file.
CVE-2010-4081 (Low severity, published 2010-09-24)
CVSS score: 1.9 (AV:L/AC:M/Au:N/C:P/I:N/A:N)
Description: The snd_hdspm_hwdep_ioctl function in sound/pci/rme9652/hdspm.c in the Linux kernel before 2.6.36-rc6 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via an SNDRV_HDSPM_IOCTL_GET_CONFIG_INFO ioctl call.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 3 and 4 as they did not include support for RME Hammerfall DSP
MADI Audio interface.
CVE-2010-1000 (Important severity, published 2010-05-12)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-22
Description: Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory traversal sequences in the name attribute of a file element in a metalink file.
CVE-2010-1450 (Low severity, published 2010-05-09)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that triggers improper processing within the (1) longimagedata or (2) expandrow function.
Statement: The Red Hat Security Response Team has rated this issue as having low security
impact, a future update may address this flaw.
CVE-2010-3178 (Moderate severity, published 2010-10-18)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 do not properly handle certain modal calls made by javascript: URLs in circumstances related to opening a new window and performing cross-domain navigation, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document.
CVE-2010-4347 (Moderate severity, published 2010-11-12)
CVSS score: 6.9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Description: The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 4, 5, and 6 as they did not include upstream commit a1a541d8 and a25ee920 that introduced the problem. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html.

Notes:

This requires debugfs to be mounted on a local system in order to have access to the custom_method file. Debugfs is not mounted by default. You need to run "mount -t debugfs nodev /sys/kernel/debug" as root first.
CVE-2010-2769 (Moderate severity, published 2010-09-06)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-79
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allows user-assisted remote attackers to inject arbitrary web script or HTML via a selection that is added to a document in which the designMode property is enabled.
CVE-2010-0304 (Moderate severity, published 2010-01-26)
CVSS score: 2.9 (AV:A/AC:M/Au:N/C:N/I:N/A:P)
Description: Multiple buffer overflows in the LWRES dissector in Wireshark 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allow remote attackers to cause a denial of service (crash) via a malformed packet, as demonstrated using a stack-based buffer overflow to the dissect_getaddrsbyname_request function.
CVE-2010-0191 (Critical severity, published 2010-04-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allow attackers to execute arbitrary code via unspecified vectors, related to a "prefix protocol handler vulnerability."
CVE-2010-1780 (Moderate severity, published 2010-08-10)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to element focus.
CVE-2010-3302 (Moderate severity, published 2010-09-26)
CVSS score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)
CWE: CWE-119
Description: Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 might allow remote authenticated gateways to execute arbitrary code or cause a denial of service via long (1) cisco_dns_info or (2) cisco_domain_info data in a packet.
CVE-2010-3752 (Moderate severity, published 2010-09-26)
CVSS score: 7.1 (AV:N/AC:H/Au:S/C:C/I:C/A:C)
CWE: CWE-78
Description: programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet, a different vulnerability than CVE-2010-3302.
CVE-2010-1295 (Critical severity, published 2010-06-28)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2210, CVE-2010-2211, and CVE-2010-2212.
CVE-2010-1915 (None severity, published 2010-05-08)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Description: The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.
Statement: Red Hat does not consider interruption issues allowing safe_mode / open_basedir
restriction bypass to be security sensitive.  For more details see
https://bugzilla.redhat.com/show_bug.cgi?id=169857#c1 and
http://www.php.net/security-note.php
CVE-2010-5110 (Moderate severity, published 2010-01-26)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-122
Description: DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.
CVE-2010-2285 (None severity, published 2010-06-08)
CVSS score: 2.9 (AV:A/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-476
Description: The SMB PIPE dissector in Wireshark 0.8.20 through 1.0.13 and 1.2.0 through 1.2.8 allows remote attackers to cause a denial of service (NULL pointer dereference) via unknown vectors.
Statement: Not vulnerable. This issue did not affect the versions of wireshark as shipped with Red Hat Enterprise Linux 3, 4, or 5.
CVE-2010-0742 (Important severity, published 2010-05-31)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.
Statement: Not vulnerable. These issues did not affect the versions of OpenSSL as shipped with Red Hat Enterprise Linux 3, 4, or 5.
CVE-2010-1850 (Important severity, published 2010-05-12)
CVSS score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Description: Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COM_FIELD_LIST command with a long table name.
Statement: These issues did not affect the versions of mysql as shipped with Red Hat Enterprise Linux 3, or 4.
CVE-2010-4351 (Important severity, published 2011-01-17)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-305
Description: The JNLP SecurityManager in IcedTea (IcedTea.so) 1.7 before 1.7.7, 1.8 before 1.8.4, and 1.9 before 1.9.4 for Java OpenJDK returns from the checkPermission method instead of throwing an exception in certain circumstances, which might allow context-dependent attackers to bypass the intended security policy by creating instances of ClassLoader.