<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0137[/INST]SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0469.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0138[/INST]The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://curl.haxx.se/docs/adv_20140326A.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.vmware.com/security/advisories/VMSA-2014-0012.html'}, {'name': '57836', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57836'}, {'name': '20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/534161/100/0/threaded'}, {'name': 'DSA-2902', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2902'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/'}, {'name': '59458', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59458'}, {'name': 'openSUSE-SU-2014:0530', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html'}, {'name': '58615', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58615'}, {'name': '20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2014/Dec/23'}, {'name': '57968', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57968'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21675820'}, {'name': 'USN-2167-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2167-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/'}, {'name': '57966', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57966'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0139[/INST]cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html'}, {'name': 'MDVSA-2015:213', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:213'}, {'name': '57836', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57836'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://curl.haxx.se/docs/adv_20140326B.html'}, {'name': 'DSA-2902', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2902'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/'}, {'name': '59458', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59458'}, {'name': 'openSUSE-SU-2014:0530', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2015-0165.html'}, {'name': '58615', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58615'}, {'name': '57968', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57968'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21675820'}, {'name': 'USN-2167-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2167-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/'}, {'name': '57966', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57966'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0140[/INST]Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.
Affected Products: n/a
References: [{'name': 'RHSA-2014:1317', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1317.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1077359'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0141[/INST]Cross-site scripting (XSS) vulnerability in Red Hat Satellite 6.0.3.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1187466'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0142[/INST]QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zero value in the (1) tracks field to the seek_to_sector function in block/parallels.c or (2) extent_size field in the bochs function in block/bochs.c.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0420', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=8e53abbc20d08ae3ec30c2054e1161314ad9501d'}, {'name': 'RHSA-2014:0421', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=9302e863aa8baa5d932fc078967050c055fa1a7f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078201'}, {'name': 'DSA-3044', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3044'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0143[/INST]Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1079140'}, {'name': 'RHSA-2014:0420', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'name': 'RHSA-2014:0421', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e3737b820b45e54b059656dc3f914f895ac7a88b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=afbcc40bee4ef51731102d7d4b499ee12fc182e1'}, {'name': 'DSA-3044', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3044'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=509a41bab5306181044b5fff02eadf96d9c8676a'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=db8a31d11d6a60f48d6817530640d75aa72a9a2f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cab60de930684c33f67d4e32c7509b567f8c445b'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0144[/INST]QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privileges of the QEMU process.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=24342f2cae47d03911e346fe1e520b00dc2818e0'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=2d51c32c4b511db8bb9e58208f1e2c25e4c06c85'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=5dab2faddc8eaa1fb1abdbe2f502001fc13a1b21'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=63fa06dc978f3669dbfd9443b33cde9e2a7f4b41'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6d4b9e55fc625514a38d27cff4b9933f617fa7dc'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7b103b36d6ef3b11827c203d3a793bf7da50ecd6'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=97f1c45c6f456572e5b504b8614e4a69e23b8e3a'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=a1b3955c9415b1e767c130a2f59fee6aa28e575b'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ce48f2f441ca98885267af6fd636a7cb804ee646'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d65f97a82c4ed48374a764c769d4ba1ea9724e97'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f56b9bc3ae20fc93815b34aa022be919941406ce'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1079240'}, {'tags': ['x_refsource_MISC'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.vulnerabilitycenter.com/#%21vul=44767'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0145[/INST]Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
Affected Products: n/a
References: [{'name': 'RHSA-2014:0420', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f0dce23475b5af5da6b17b97c1765271307734b6'}, {'name': 'RHSA-2014:0421', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html'}, {'name': 'DSA-3044', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3044'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=c165f7758009a4f793c1fc19ebb69cf55313450b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078885'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c05e4667be91b46ab42b5a11babf8e84d476cc6b'}, {'name': '[oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/03/26/8'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0146[/INST]The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=11b128f4062dd7f89b14abc8877ff20d41b28be9'}, {'name': 'RHSA-2014:0420', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'name': 'RHSA-2014:0421', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078232'}, {'name': 'DSA-3044', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3044'}, {'name': '[oss-security] 20140326 QEMU image format input validation fixes (multiple CVEs)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/03/26/8'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0147[/INST]Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.
Affected Products: Qemu
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=246f65838d19db6db55bfb41117c35645a2c4789'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078848'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1086717'}, {'tags': ['x_refsource_MISC'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/03/26/8'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0148[/INST]Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
Affected Products: Qemu
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0420.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0421.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/03/26/8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d7678dec4761acdc43439da6ceda41a703ba1a6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078212'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0149[/INST]Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0462', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0462.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078646'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0150[/INST]Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1078846'}, {'name': 'DSA-2910', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2910'}, {'name': 'USN-2182-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2182-1'}, {'name': 'DSA-2909', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2909'}, {'name': '57878', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57878'}, {'name': '[Qemu-devel] 20140411 Re: [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://article.gmane.org/gmane.comp.emulators.qemu/266768'}, {'name': '[Qemu-devel] 20140411 [PATCH for-2.0] virtio-net: fix guest-triggerable buffer overrun', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://thread.gmane.org/gmane.comp.emulators.qemu/266713'}, {'name': '58191', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58191'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0151[/INST]Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1077441'}, {'name': 'RHSA-2015:0158', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0158.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ovirt.org/OVirt_3.5_Release_Notes'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0152[/INST]Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://gerrit.ovirt.org/#/c/25959/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ovirt.org/Security_advisories'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0153[/INST]The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://gerrit.ovirt.org/#/c/25987/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ovirt.org/Security_advisories'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0154[/INST]oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Products: n/a
References: [{'name': 'RHSA-2015:0158', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0158.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1077450'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0155[/INST]The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC.  NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1081589'}, {'name': '[oss-security] 20140407 CVE-2014-0155 -- kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/07/2'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0156[/INST]Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.
Affected Products: awesome_spawn
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://rubysec.com/advisories/CVE-2014-0156/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ManageIQ/awesome_spawn/commit/e524f85f1c6e292ef7d117d7818521307ac269ff'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0157[/INST]Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.
Affected Products: n/a
References: [{'name': '66706', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66706'}, {'name': '[oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/08/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/1289033'}, {'name': 'openSUSE-SU-2015:0078', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0158[/INST]Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file because of incorrect j2k_decode, j2k_read_eoc, and tcd_decode_tile interaction, a related issue to CVE-2013-6045. NOTE: this is not a duplicate of CVE-2013-1447, because the scope of CVE-2013-1447 was specifically defined in http://openwall.com/lists/oss-security/2013/12/04/6 as only "null pointer dereferences, division by zero, and anything that would just fit as DoS."
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1082925'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.suse.com/show_bug.cgi?id=871412'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0159[/INST]Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://openafs.org/pages/security/OPENAFS-SA-2014-001.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/frameset/dl/openafs/1.6.7/ChangeLog'}, {'name': '57779', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57779'}, {'name': 'MDVSA-2014:244', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:244'}, {'name': '57832', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57832'}, {'name': 'DSA-2899', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2899'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0160[/INST]The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Affected Products: n/a
References: [{'url': 'https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217'}, {'name': '1030077', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030077'}, {'name': '20140408 heartbleed OpenSSL bug CVE-2014-0160', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/90'}, {'url': 'http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/'}, {'name': 'DSA-2896', 'tags': ['vendor-advisory'], 'url': 'http://www.debian.org/security/2014/dsa-2896'}, {'name': 'HPSBGN03008', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139774054614965&w=2'}, {'name': 'HPSBMU03024', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139889113431619&w=2'}, {'name': 'RHSA-2014:0396', 'tags': ['vendor-advisory'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0396.html'}, {'name': 'HPSBHF03021', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139835815211508&w=2'}, {'name': 'HPSBHF03136', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=141287864628122&w=2'}, {'name': 'VU#720951', 'tags': ['third-party-advisory'], 'url': 'http://www.kb.cert.org/vuls/id/720951'}, {'url': 'http://www.splunk.com/view/SP-CAAAMB3'}, {'name': 'HPSBMU03033', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905295427946&w=2'}, {'url': 'http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0'}, {'url': 'http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf'}, {'name': 'HPSBGN03011', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139833395230364&w=2'}, {'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21670161'}, {'url': 'http://www.vmware.com/security/advisories/VMSA-2014-0012.html'}, {'name': 'openSUSE-SU-2014:0492', 'tags': ['vendor-advisory'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00004.html'}, {'name': 'SSRT101846', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=142660345230545&w=2'}, {'name': '20140409 Re: heartbleed OpenSSL bug CVE-2014-0160', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/109'}, {'name': 'HPSBMU03037', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=140724451518351&w=2'}, {'name': '1030080', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030080'}, {'name': '57836', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/57836'}, {'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg400001843'}, {'name': 'HPSBMU03012', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139808058921905&w=2'}, {'name': 'HPSBST03001', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139758572430452&w=2'}, {'name': '66690', 'tags': ['vdb-entry'], 'url': 'http://www.securityfocus.com/bid/66690'}, {'url': 'http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf'}, {'url': 'https://filezilla-project.org/versions.php?type=server'}, {'name': 'HPSBMU03023', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139843768401936&w=2'}, {'name': '57483', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/57483'}, {'name': '20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products', 'tags': ['vendor-advisory'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed'}, {'url': 'http://www.kerio.com/support/kerio-control/release-history'}, {'url': 'http://advisories.mageia.org/MGASA-2014-0165.html'}, {'url': 'http://www.blackberry.com/btsc/KB35882'}, {'name': 'HPSBHF03293', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=142660345230545&w=2'}, {'name': 'HPSBMU03044', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=140075368411126&w=2'}, {'name': 'HPSBMU03030', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905351928096&w=2'}, {'name': '1030081', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030081'}, {'name': 'FEDORA-2014-4879', 'tags': ['vendor-advisory'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131221.html'}, {'name': '20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities', 'tags': ['mailing-list'], 'url': 'http://www.securityfocus.com/archive/1/534161/100/0/threaded'}, {'name': 'FEDORA-2014-4910', 'tags': ['vendor-advisory'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-April/131291.html'}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1084875'}, {'name': 'FEDORA-2014-9308', 'tags': ['vendor-advisory'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html'}, {'url': 'http://www-01.ibm.com/support/docview.wss?uid=isg400001841'}, {'name': 'HPSBMU03013', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139824993005633&w=2'}, {'name': '1030079', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030079'}, {'name': 'RHSA-2014:0377', 'tags': ['vendor-advisory'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0377.html'}, {'name': 'HPSBMU02995', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139722163017074&w=2'}, {'name': 'HPSBPI03031', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139889295732144&w=2'}, {'url': 'https://code.google.com/p/mod-spdy/issues/detail?id=85'}, {'name': 'HPSBMU02999', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139765756720506&w=2'}, {'name': 'HPSBGN03010', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139774703817488&w=2'}, {'name': 'HPSBMU03029', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905202427693&w=2'}, {'url': 'http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/'}, {'url': 'http://heartbleed.com/'}, {'name': 'HPSBMU03018', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139817782017443&w=2'}, {'url': 'http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01'}, {'name': 'HPSBMU03040', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=140015787404650&w=2'}, {'url': 'http://cogentdatahub.com/ReleaseNotes.html'}, {'name': 'HPSBMU03025', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139869720529462&w=2'}, {'name': 'HPSBST03016', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139842151128341&w=2'}, {'name': 'HPSBMU03028', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905243827825&w=2'}, {'name': 'HPSBMU03009', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905458328378&w=2'}, {'url': 'http://www.f-secure.com/en/web/labs_global/fsc-2014-1'}, {'name': 'TA14-098A', 'tags': ['third-party-advisory'], 'url': 'http://www.us-cert.gov/ncas/alerts/TA14-098A'}, {'name': '57347', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/57347'}, {'name': '[syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released', 'tags': ['mailing-list'], 'url': 'https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-April/000184.html'}, {'name': '20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/173'}, {'url': 'https://blog.torproject.org/blog/openssl-bug-cve-2014-0160'}, {'url': 'http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html'}, {'url': 'http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html'}, {'url': 'https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html'}, {'url': 'http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3'}, {'name': 'HPSBST03000', 'tags': ['vendor-advisory'], 'url': 'https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04260637-4%257CdocLocale%253Den_US%257CcalledBy%253DSearch_Result&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken'}, {'name': '20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2014/Dec/23'}, {'name': 'HPSBST03004', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905653828999&w=2'}, {'name': 'USN-2165-1', 'tags': ['vendor-advisory'], 'url': 'http://www.ubuntu.com/usn/USN-2165-1'}, {'name': 'RHSA-2014:0378', 'tags': ['vendor-advisory'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0378.html'}, {'name': 'HPSBMU02997', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139757919027752&w=2'}, {'name': 'SUSE-SA:2014:002', 'tags': ['vendor-advisory'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00005.html'}, {'name': '32764', 'tags': ['exploit'], 'url': 'http://www.exploit-db.com/exploits/32764'}, {'name': 'HPSBMU02994', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139757726426985&w=2'}, {'url': 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00'}, {'name': 'HPSBMU03022', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139869891830365&w=2'}, {'name': 'HPSBST03027', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905868529690&w=2'}, {'name': 'HPSBMU03019', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139817685517037&w=2'}, {'name': 'HPSBMU03062', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=140752315422991&w=2'}, {'name': '20140408 Re: heartbleed OpenSSL bug CVE-2014-0160', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/91'}, {'name': '1030078', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030078'}, {'name': '59243', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/59243'}, {'url': 'http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661'}, {'name': 'HPSBMU03020', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139836085512508&w=2'}, {'name': 'HPSBST03015', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139824923705461&w=2'}, {'name': 'RHSA-2014:0376', 'tags': ['vendor-advisory'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0376.html'}, {'name': 'HPSBPI03014', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139835844111589&w=2'}, {'name': 'MDVSA-2015:062', 'tags': ['vendor-advisory'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:062'}, {'url': 'https://www.cert.fi/en/reports/2014/vulnerability788210.html'}, {'name': '57721', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/57721'}, {'name': '57968', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/57968'}, {'url': 'http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/'}, {'url': 'http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3'}, {'name': 'openSUSE-SU-2014:0560', 'tags': ['vendor-advisory'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-04/msg00061.html'}, {'name': 'HPSBMU03032', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139905405728262&w=2'}, {'name': '1030082', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030082'}, {'name': 'HPSBMU02998', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139757819327350&w=2'}, {'name': '32745', 'tags': ['exploit'], 'url': 'http://www.exploit-db.com/exploits/32745'}, {'name': '20140412 Re: heartbleed OpenSSL bug CVE-2014-0160', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2014/Apr/190'}, {'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/'}, {'name': 'HPSBMU03017', 'tags': ['vendor-advisory'], 'url': 'http://marc.info/?l=bugtraq&m=139817727317190&w=2'}, {'url': 'https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008'}, {'url': 'http://www.openssl.org/news/secadv_20140407.txt'}, {'url': 'https://gist.github.com/chapmajs/10473815'}, {'url': 'http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1'}, {'name': '1030074', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030074'}, {'url': 'http://support.citrix.com/article/CTX140605'}, {'name': '59139', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/59139'}, {'url': 'http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/'}, {'name': '57966', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/57966'}, {'name': '1030026', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1030026'}, {'name': '59347', 'tags': ['third-party-advisory'], 'url': 'http://secunia.com/advisories/59347'}, {'name': '[tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/', 'tags': ['mailing-list'], 'url': 'https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E'}, {'name': '[tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/', 'tags': ['mailing-list'], 'url': 'https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E'}, {'url': 'https://sku11army.blogspot.com/2020/01/heartbleed-hearts-continue-to-bleed.html'}, {'name': '[tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/', 'tags': ['mailing-list'], 'url': 'https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E'}, {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-635659.pdf'}, {'name': '[tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/', 'tags': ['mailing-list'], 'url': 'https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E'}, {'url': 'https://yunus-shn.medium.com/ricon-industrial-cellular-router-heartbleed-attack-2634221c02bd'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0161[/INST]ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.
Affected Products: ovirt-engine-sdk-python
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0161'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0161'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0162[/INST]The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.
Affected Products: n/a
References: [{'name': 'USN-2193-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2193-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/1298698'}, {'name': '[oss-security] 20140410 [OSSA 2014-012] Remote code execution in Glance Sheepdog backend (CVE-2014-0162)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/10/13'}, {'name': 'RHSA-2014:0455', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0455.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0163[/INST]Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.
Affected Products: Openshift
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0163'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0163'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0164[/INST]openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0461', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0461.html'}, {'name': 'RHSA-2014:0460', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0460.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0165[/INST]WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.7.2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://core.trac.wordpress.org/changeset/27976'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.8.2'}, {'name': 'DSA-2901', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2901'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1085866'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0166[/INST]The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.7.2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1085858'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://codex.wordpress.org/Version_3.8.2'}, {'name': 'DSA-2901', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2901'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://core.trac.wordpress.org/changeset/28054'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0167[/INST]The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Affected Products: n/a
References: [{'name': '[oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API  (CVE-2014-0167)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/09/26'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/bugs/1290537'}, {'name': 'USN-2247-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2247-1'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0168[/INST]Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/rhuss/jolokia/commit/2d9b168cfbbf5a6d16fa6e8a5b34503e3dc42364'}, {'name': 'RHSA-2014:1351', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1351.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0169[/INST]In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an intended functionality, it was not clearly documented which can mislead users into thinking that a security domain cache is isolated to a single application.
Affected Products: JBoss EAP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0169'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0169'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0170[/INST]Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.
Affected Products: n/a
References: [{'name': 'jboss-data-cve20140170-info-disc(96192)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/96192'}, {'name': '61530', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61530'}, {'name': '1030886', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.jboss.org/browse/TEIID-2911'}, {'name': 'RHSA-2014:1284', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1284.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0171[/INST]XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
Affected Products: n/a
References: [{'name': 'RHSA-2015:0034', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0034.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.jboss.org/browse/TEIID-2911'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0172[/INST]Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '[oss-security] 20140409 Heap-based buffer overflow in libdw/elfutils (CVE-2014-0172)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q2/54'}, {'name': '[elfutils-devel] 20140409 [PATCH] CVE-2014-0172 Check for overflow before calling malloc to uncompress data.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.fedorahosted.org/pipermail/elfutils-devel/2014-April/003921.html'}, {'name': 'GLSA-201612-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-32'}, {'name': '66714', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66714'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1085663'}, {'name': 'USN-2188-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2188-1'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0173[/INST]The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://jetpack.me/2014/04/10/jetpack-security-update/'}, {'name': '66789', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66789'}, {'name': 'jetpack-wordpress-cve20140173-sec-bypass(92560)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/92560'}, {'name': '57729', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57729'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0174[/INST]Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0858', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0858.html'}, {'name': 'RHSA-2014:0859', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0859.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0175[/INST]mcollective has a default password set at install
Affected Products: mcollective
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-0175'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0175'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0175'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0176[/INST]Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0816', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0816.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0177[/INST]The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.
Affected Products: n/a
References: [{'name': '58273', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/58273'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/github/hub/commit/016ec99d25b1cb83cb4367e541177aa431beb600'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0178[/INST]Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.
Affected Products: n/a
References: [{'name': '67686', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67686'}, {'name': 'MDVSA-2014:136', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:136'}, {'name': 'FEDORA-2014-9132', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136864.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/security/CVE-2014-0178'}, {'name': '1030308', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1030308'}, {'name': '20140711 [ MDVSA-2014:136 ] samba', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/532757/100/0/threaded'}, {'name': 'GLSA-201502-15', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201502-15.xml'}, {'name': '59407', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59407'}, {'name': 'FEDORA-2014-7672', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134717.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://advisories.mageia.org/MGASA-2014-0279.html'}, {'name': '59378', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59378'}, {'name': 'MDVSA-2015:082', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2015:082'}, {'name': '59579', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59579'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0179[/INST]libvirt 0.7.5 through 1.2.x before 1.2.5 allows local users to cause a denial of service (read block and hang) via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virConnectCompareCPU or (2) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT per ADT3 due to different affected versions of some vectors. CVE-2014-5177 is used for other API methods.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0560', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0560.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libvirt.org/news.html'}, {'name': '60895', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60895'}, {'name': 'GLSA-201412-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201412-04.xml'}, {'name': 'openSUSE-SU-2014:0674', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00052.html'}, {'name': 'DSA-3038', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-3038'}, {'name': 'openSUSE-SU-2014:0650', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-05/msg00048.html'}, {'name': 'USN-2366-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2366-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://security.libvirt.org/2014/0003.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0180[/INST]The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0816', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0816.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0181[/INST]The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.45'}, {'name': 'SUSE-SU-2015:0736', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html'}, {'name': 'SUSE-SU-2015:0652', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9'}, {'name': 'SUSE-SU-2015:0481', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html'}, {'name': '[oss-security] 20140423 Re: CVE-2014-0181: Linux network reconfiguration due to incorrect netlink checks', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/23/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=90f62cf30a78721641e08737bda787552428061e'}, {'name': 'openSUSE-SU-2015:0566', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html'}, {'name': 'RHSA-2014:1959', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-1959.html'}, {'name': '[netdev] 20140423 [PATCH 0/5]: Preventing abuse when passing file descriptors', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://marc.info/?l=linux-netdev&m=139828832919748&w=2'}, {'name': 'SUSE-SU-2015:0812', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html'}, {'url': 'http://www.openwall.com/lists/oss-security/2023/04/16/3'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0182[/INST]Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0743', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0743.html'}, {'name': '[Qemu-stable] 20140723 [ANNOUNCE] QEMU 1.7.2 Stable released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html'}, {'name': 'RHSA-2014:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0744.html'}, {'name': 'FEDORA-2014-6288', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=a890a2f9137ac3cf5b607649e66a6f3a5512d8dc'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0183[/INST]Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.
Affected Products: Katello
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0183'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0183'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0184[/INST]Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0816', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0816.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0185[/INST]sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
Affected Products: n/a
References: [{'name': '59329', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59329'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/php/php-src/commit/35ceea928b12373a3b1e3eecdc32ed323223a40d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=67060'}, {'name': '59061', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59061'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/archive/2014.php#id2014-05-01-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6443'}, {'name': '[oss-security] 20140429 Fwd: [vs] php-fpm: privilege escalation due to insecure default config (CVE-2014-0185)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/29/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1092815'}, {'name': 'openSUSE-SU-2015:1685', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-10/msg00012.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0186[/INST]A certain tomcat7 package for Apache Tomcat 7 in Red Hat Enterprise Linux (RHEL) 7 allows remote attackers to cause a denial of service (CPU consumption) via a crafted request.  NOTE: this vulnerability exists because of an unspecified regression.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0686', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2014-0686.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1089884'}, {'name': '108060', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/108060'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-0186'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0187[/INST]The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:1051', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-08/msg00035.html'}, {'name': '[oss-security] 20140422 [OSSA 2014-014] Neutron security groups bypass through invalid CIDR (CVE-2014-0187)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/22/8'}, {'name': '59533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59533'}, {'name': 'USN-2255-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2255-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/neutron/+bug/1300785'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0188[/INST]The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0422', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0422.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1090120'}, {'name': 'RHSA-2014:0423', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0423.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0189[/INST]virt-who uses world-readable permissions for /etc/sysconfig/virt-who, which allows local users to obtain password for hypervisors by reading the file.
Affected Products: n/a
References: [{'name': '67089', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67089'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1088732'}, {'name': '[oss-security] 20140428 CVE-2014-0189: /etc/sysconfig/virt-who is world-readable (contains unencrypted passwords)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/04/28/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1081286'}, {'name': 'RHSA-2015:0430', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0430.html'}]
CVE State: PUBLISHED</s>


<s>[INST] <<SYS>> You are a helpful, respectful and honest assistant. Always answer as helpfully as possible, while being safe.  Your answers should not include any harmful, unethical, racist, sexist, toxic, dangerous, or illegal content. Please ensure that your responses are socially unbiased and positive in nature. If a question does not make any sense, or is not factually coherent, explain why instead of answering something not correct. If you don't know the answer to a question, please don't share false information. <</SYS>> Explain the vulnerability: CVE-2014-0190[/INST]The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.kde.org/show_bug.cgi?id=333404'}, {'name': 'openSUSE-SU-2015:0573', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html'}, {'name': 'FEDORA-2014-6922', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134040.html'}, {'name': 'USN-2626-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2626-1'}, {'name': '[Announce] 20140424 Qt Security Advisory: DoS vulnerability in the GIF image handler', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.qt-project.org/pipermail/announce/2014-April/000045.html'}, {'name': 'FEDORA-2014-6896', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134141.html'}, {'name': 'FEDORA-2014-5695', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132395.html'}, {'name': '67087', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/67087'}]
CVE State: PUBLISHED</s>