{
  "rook/ceph:v1.1.1": {
    "Results": [
      {
        "Type": "centos",
        "Target": "rook/ceph:v1.1.1 (centos 7.7.1908)",
        "Vulnerabilities": [
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "PyYAML: yaml.load() API could execute arbitrary code",
            "PkgName": "PyYAML",
            "Severity": "MEDIUM",
            "References": [
              "https://github.com/advisories/GHSA-rprw-h62v-c2w7",
              "https://github.com/marshmallow-code/apispec/issues/278",
              "https://github.com/yaml/pyyaml/blob/master/CHANGES",
              "https://github.com/yaml/pyyaml/issues/193",
              "https://github.com/yaml/pyyaml/pull/74",
              "https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEX7IPV5P2QJITAMA5Z63GQCZA5I6NVZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSQQMRUQSXBSUXLCRD3TSZYQ7SEZRKCE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6JCFGEIEOFMWWIXGHSELMKQDD4CV2BA/",
              "https://nvd.nist.gov/vuln/detail/CVE-2017-18342",
              "https://security.gentoo.org/glsa/202003-45"
            ],
            "Description": "In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18342",
            "InstalledVersion": "3.10-11.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Audit: log terminal emulator escape sequences handling",
            "PkgName": "audit-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/08/13/9",
              "http://www.securityfocus.com/bid/76840",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1251621",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5186",
              "https://people.redhat.com/sgrubb/audit/ChangeLog"
            ],
            "Description": "Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5186",
            "InstalledVersion": "2.8.5-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Audit: log terminal emulator escape sequences handling",
            "PkgName": "audit-libs-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/08/13/9",
              "http://www.securityfocus.com/bid/76840",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1251621",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5186",
              "https://people.redhat.com/sgrubb/audit/ChangeLog"
            ],
            "Description": "Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5186",
            "InstalledVersion": "2.8.5-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "avahi: Multicast DNS responds to unicast queries outside of local network",
            "PkgName": "avahi-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2017-6519.html",
              "http://linux.oracle.com/errata/ELSA-2020-1176.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1426712",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6519",
              "https://github.com/lathiat/avahi/issues/203",
              "https://github.com/lathiat/avahi/issues/203#issuecomment-449536790",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://usn.ubuntu.com/3876-1/",
              "https://usn.ubuntu.com/3876-2/",
              "https://usn.ubuntu.com/usn/usn-3876-1",
              "https://usn.ubuntu.com/usn/usn-3876-2",
              "https://www.kb.cert.org/vuls/id/550620",
              "https://www.secfu.net/advisories"
            ],
            "Description": "avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive  information from the responding device via port-5353 UDP packets.  NOTE: this may overlap CVE-2015-2809.",
            "FixedVersion": "0.6.31-20.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6519",
            "InstalledVersion": "0.6.31-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bash: heap-based buffer overflow during echo of unsupported characters",
            "PkgName": "bash",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5",
              "http://www.securityfocus.com/bid/108824",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1721071",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6711",
              "https://support.f5.com/csp/article/K05122252",
              "https://support.f5.com/csp/article/K05122252?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4180-1/"
            ],
            "Description": "A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the \"echo -e\" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2012-6711",
            "InstalledVersion": "4.2.46-33.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bash: BASH_CMD is writable in restricted bash shells",
            "PkgName": "bash",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65",
              "http://linux.oracle.com/cve/CVE-2019-9924.html",
              "http://linux.oracle.com/errata/ELSA-2020-1113.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00049.html",
              "https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1803441",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9924",
              "https://lists.debian.org/debian-lts-announce/2019/03/msg00028.html",
              "https://lists.gnu.org/archive/html/bug-bash/2017-03/msg00077.html",
              "https://security.netapp.com/advisory/ntap-20190411-0001/",
              "https://usn.ubuntu.com/4058-1/",
              "https://usn.ubuntu.com/4058-2/",
              "https://usn.ubuntu.com/usn/usn-4058-1",
              "https://usn.ubuntu.com/usn/usn-4058-2"
            ],
            "Description": "rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.",
            "FixedVersion": "4.2.46-34.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9924",
            "InstalledVersion": "4.2.46-33.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bash: when effective UID is not equal to its real UID the saved UID is not dropped",
            "PkgName": "bash",
            "Severity": "LOW",
            "References": [
              "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
              "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
              "https://security.netapp.com/advisory/ntap-20200430-0003/",
              "https://www.youtube.com/watch?v=-wGtxJ8opa8"
            ],
            "Description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18276",
            "InstalledVersion": "4.2.46-33.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 8.6,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 8.6,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: BIND does not sufficiently limit the number of fetches performed when processing referrals",
            "PkgName": "bind-license",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8616.html",
              "http://linux.oracle.com/errata/ELSA-2020-2383.html",
              "http://www.nxnsattack.com",
              "http://www.openwall.com/lists/oss-security/2020/05/19/4",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8616",
              "https://kb.isc.org/docs/cve-2020-8616",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/",
              "https://security.netapp.com/advisory/ntap-20200522-0002/",
              "https://usn.ubuntu.com/4365-1/",
              "https://usn.ubuntu.com/4365-2/",
              "https://usn.ubuntu.com/usn/usn-4365-1",
              "https://usn.ubuntu.com/usn/usn-4365-2",
              "https://www.debian.org/security/2020/dsa-4689",
              "https://www.synology.com/security/advisory/Synology_SA_20_12",
              "https://www.theregister.co.uk/2020/05/21/nxnaattack_bug_disclosed/"
            ],
            "Description": "A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.",
            "FixedVersion": "32:9.11.4-16.P2.el7_8.6",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8616",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c",
            "PkgName": "bind-license",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8617.html",
              "http://linux.oracle.com/errata/ELSA-2020-2383.html",
              "http://packetstormsecurity.com/files/157836/BIND-TSIG-Denial-Of-Service.html",
              "http://www.openwall.com/lists/oss-security/2020/05/19/4",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8617",
              "https://kb.isc.org/docs/cve-2020-8617",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00031.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKJXVBOKZ36ER3EUCR7VRB7WGHIIMPNJ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WOGCJS2XQ3SQNF4W6GLZ73LWZJ6ZZWZI/",
              "https://security.netapp.com/advisory/ntap-20200522-0002/",
              "https://usn.ubuntu.com/4365-1/",
              "https://usn.ubuntu.com/4365-2/",
              "https://usn.ubuntu.com/usn/usn-4365-1",
              "https://usn.ubuntu.com/usn/usn-4365-2",
              "https://www.debian.org/security/2020/dsa-4689"
            ],
            "Description": "Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.",
            "FixedVersion": "32:9.11.4-16.P2.el7_8.6",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8617",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: TCP Pipelining doesn't limit TCP clients on a single connection",
            "PkgName": "bind-license",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-6477.html",
              "http://linux.oracle.com/errata/ELSA-2020-1845.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6477",
              "https://kb.isc.org/docs/cve-2019-6477",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3DEMNZMKR57VQJCG5ZN55ZGTQRL2TFQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XGURMGQHX45KR4QDRCSUQHODUFOGNGAN/",
              "https://support.f5.com/csp/article/K15840535?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/usn/usn-4197-1",
              "https://www.debian.org/security/2020/dsa-4689",
              "https://www.synology.com/security/advisory/Synology_SA_19_39"
            ],
            "Description": "With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query received via UDP or via TCP without pipelining enabled. A client using a TCP-pipelined connection to a server could consume more resources than the server has been provisioned to handle. When a TCP connection with a large number of pipelined queries is closed, the load on the server releasing these multiple resources can cause it to become unresponsive, even for queries that can be answered authoritatively or from cache. (This is most likely to be perceived as an intermittent server problem).",
            "FixedVersion": "32:9.11.4-16.P2.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-6477",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: truncated TSIG response can lead to an assertion failure",
            "PkgName": "bind-license",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8622.html",
              "http://linux.oracle.com/errata/ELSA-2020-4183.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8622",
              "https://kb.isc.org/docs/cve-2020-8622",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/",
              "https://security.gentoo.org/glsa/202008-19",
              "https://security.netapp.com/advisory/ntap-20200827-0003/",
              "https://usn.ubuntu.com/4468-1/",
              "https://usn.ubuntu.com/4468-2/",
              "https://usn.ubuntu.com/usn/usn-4468-1",
              "https://usn.ubuntu.com/usn/usn-4468-2",
              "https://www.debian.org/security/2020/dsa-4752",
              "https://www.synology.com/security/advisory/Synology_SA_20_19"
            ],
            "Description": "In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8622",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: remotely triggerable assertion failure in pk11.c",
            "PkgName": "bind-license",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8623",
              "https://kb.isc.org/docs/cve-2020-8623",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00053.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DQN62GBMCIC5AY4KYADGXNKVY6AJKSJE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKAMJZXR66P6S5LEU4SN7USSNCWTXEXP/",
              "https://security.gentoo.org/glsa/202008-19",
              "https://security.netapp.com/advisory/ntap-20200827-0003/",
              "https://usn.ubuntu.com/4468-1/",
              "https://usn.ubuntu.com/usn/usn-4468-1",
              "https://www.debian.org/security/2020/dsa-4752",
              "https://www.synology.com/security/advisory/Synology_SA_20_19"
            ],
            "Description": "In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with \"--enable-native-pkcs11\" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8623",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "DNS response rate limiting can simplify cache poisoning attacks",
            "PkgName": "bind-license",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-5661",
              "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-5661",
              "https://security-tracker.debian.org/tracker/CVE-2013-5661"
            ],
            "Description": "Cache Poisoning issue exists in DNS Response Rate Limiting.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-5661",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: Improper restriction of zone size limit",
            "PkgName": "bind-license",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/07/06/3",
              "http://www.securityfocus.com/bid/91611",
              "http://www.securitytracker.com/id/1036241",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1353563",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6170",
              "https://github.com/sischkg/xfer-limit/blob/master/README.md",
              "https://kb.isc.org/article/AA-01390",
              "https://kb.isc.org/article/AA-01390/0/Operational-Notification%3A-A-party-that-is-allowed-control-over-zone-data-can-overwhelm-a-server-by-transferring-huge-quantities-of-data.html",
              "https://kb.isc.org/article/AA-01390/169/CVE-2016-6170",
              "https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015058.html",
              "https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015073.html",
              "https://lists.dns-oarc.net/pipermail/dns-operations/2016-July/015075.html",
              "https://security.gentoo.org/glsa/201610-07"
            ],
            "Description": "ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6170",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.5,
                "V3Score": 4.9,
                "V2Vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.9,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: An assertion failure if a trust anchor rolls over to an unsupported key algorithm when using managed-keys",
            "PkgName": "bind-license",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-5745.html",
              "http://linux.oracle.com/errata/ELSA-2020-1061.html",
              "https://access.redhat.com/errata/RHSA-2019:3552",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5745",
              "https://kb.isc.org/docs/cve-2018-5745",
              "https://usn.ubuntu.com/usn/usn-3893-1",
              "https://usn.ubuntu.com/usn/usn-3893-2"
            ],
            "Description": "\"managed-keys\" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Due to an error in the managed-keys feature it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P1, 9.12.0 -> 9.12.3-P1, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5745.",
            "FixedVersion": "32:9.11.4-16.P2.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-5745",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "bind: Controls for zone transfers may not be properly applied to DLZs if the zones are writable",
            "PkgName": "bind-license",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-6465.html",
              "http://linux.oracle.com/errata/ELSA-2020-1061.html",
              "https://access.redhat.com/errata/RHSA-2019:3552",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6465",
              "https://kb.isc.org/docs/cve-2019-6465",
              "https://usn.ubuntu.com/usn/usn-3893-1",
              "https://usn.ubuntu.com/usn/usn-3893-2"
            ],
            "Description": "Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.5-P2, 9.12.0 -> 9.12.3-P2, and versions 9.9.3-S1 -> 9.11.5-S3 of BIND 9 Supported Preview Edition. Versions 9.13.0 -> 9.13.6 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2019-6465.",
            "FixedVersion": "32:9.11.4-16.P2.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-6465",
            "InstalledVersion": "32:9.11.4-9.P2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer overflow in target_specific_reloc_handling in readelf",
            "PkgName": "binutils",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6965",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21137"
            ],
            "Description": "readelf in GNU Binutils 2.28 writes to illegal addresses while processing corrupt input files containing symbol-difference relocations, leading to a heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6965",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Use-after-free in target_specific_reloc_handling in readelf",
            "PkgName": "binutils",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6966",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21139"
            ],
            "Description": "readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple, relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index, and mishandling of state across invocations.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6966",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Integer overflow in demangle_template() function",
            "PkgName": "binutils",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/106454",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24039"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for \"Create an array for saving the template argument values\") that can trigger a heap-based buffer overflow, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20673",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out-of-bound read in function bfd_getl32 in libbfd.c",
            "PkgName": "binutils",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9074",
              "https://security.netapp.com/advisory/ntap-20190314-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24235",
              "https://support.f5.com/csp/article/K09092524",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an out-of-bounds read leading to a SEGV in bfd_getl32 in libbfd.c, when called from pex64_get_runtime_function in pei-x86_64.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9074",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer overflow in function _bfd_archive_64_bit_slurp_armap in archive64.c",
            "PkgName": "binutils",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9075",
              "https://security.netapp.com/advisory/ntap-20190314-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24236",
              "https://support.f5.com/csp/article/K42059040",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is a heap-based buffer overflow in _bfd_archive_64_bit_slurp_armap in archive64.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9075",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer overflow in function process_mips_specific in readelf.c",
            "PkgName": "binutils",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/107139",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9077",
              "https://security.netapp.com/advisory/ntap-20190314-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24243",
              "https://support.f5.com/csp/article/K00056379",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in GNU Binutils 2.32. It is a heap-based buffer overflow in process_mips_specific in readelf.c via a malformed MIPS option section.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9077",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: buffer overflow in ihex.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/07/31/6",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9939",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=18750",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7e27a9d5f22f9f7ead11738b1546d0b5c737266b",
              "https://usn.ubuntu.com/usn/usn-3367-1"
            ],
            "Description": "ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9939",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.7,
                "V2Vector": "AV:L/AC:L/Au:S/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libdwarf: Out-of-bounds read in dwarf_leb.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://sourceforge.net/p/libdwarf/code/ci/da724a0bc5eec8e9ec0b0cb0c238a80e34466459/",
              "http://www.openwall.com/lists/oss-security/2015/12/09/2",
              "http://www.openwall.com/lists/oss-security/2015/12/10/3",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1289385",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1291299",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8538"
            ],
            "Description": "dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8538",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Exploitable buffer overflow",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2226",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1",
              "https://www.exploit-db.com/exploits/42386/"
            ],
            "Description": "Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2226",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array btypevec",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4487",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4487",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array ktypevec",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4488",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"ktypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4488",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to integer overflow",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4489",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70492",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the \"demangling of virtual tables.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4489",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Write access violation",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90019",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4490",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70498",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4490",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Stack overflow due to infinite recursion in d_print_comp",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90016",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4491",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70909",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00105.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having \"itself as ancestor more than once.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4491",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 4.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4492",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4492",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4493",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4493",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds heap read in _bfd_vms_save_sized_string function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12449",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21840"
            ],
            "Description": "The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12449",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds stack read in _bfd_xcoff_read_ar_hdr function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12451",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21786"
            ],
            "Description": "The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12451",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds heap read in bfd_mach_o_i386_canonicalize_one_reloc function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12452",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21813"
            ],
            "Description": "The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12452",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds heap read in __bfd_vms_slurp_eeom function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12453",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21813"
            ],
            "Description": "The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12453",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Arbitrary memory read in _bfd_vms_slurp_egs function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12454",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21813"
            ],
            "Description": "The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12454",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds heap read in evax_bfd_print_emh function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12455",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21840"
            ],
            "Description": "The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12455",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds heap read in read_symbol_stabs_debugging_inf function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12456",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21813"
            ],
            "Description": "The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12456",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in bfd_make_section_with_flags function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12457",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21840"
            ],
            "Description": "The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12457",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds heap read in nlm_swap_auxiliary_headers_in function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12458",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21840"
            ],
            "Description": "The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12458",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based 1 byte buffer over-write in elf_read_notes function in bfd/elf.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100292",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12799",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21933"
            ],
            "Description": "The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12799",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack-based buffer over-read in getsym function in tekhex.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100462",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12967",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21962"
            ],
            "Description": "The getsym function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a malformed tekhex binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12967",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the setup_group function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100499",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13710",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0c54f69295208331faab9bc5e995111a35672f9b",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d6f8dea6798528de0fc762409595251eeeb1f547"
            ],
            "Description": "The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13710",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Memory leak with the C++ symbol demangler routine in libiberty",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13716",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22009"
            ],
            "Description": "The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13716",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer over-read in elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100532",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13757",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22018",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=90efb6422939ca031804266fba669f77c22a274a"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the PLT section size, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to elf_i386_get_synthetic_symtab in elf32-i386.c and elf_x86_64_get_synthetic_symtab in elf64-x86-64.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13757",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in the decode_line_info function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100623",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14128",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22059",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7e8b60085eb3e6f2c41bc0c00c0d759fa7f72780"
            ],
            "Description": "The decode_line_info function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (read_1_byte heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14128",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in the read_section function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100624",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14129",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22047",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e4f2723003859dc6b33ca0dadbc4a7659ebf1643"
            ],
            "Description": "The read_section function in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (parse_comp_unit heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14129",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in the _bfd_elf_parse_attributes function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/100625",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14130",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22058",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=2a143b99fc4a5094a9cf128f3184d8e6818c8229"
            ],
            "Description": "The _bfd_elf_parse_attributes function in elf-attrs.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (_bfd_elf_attr_strdup heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14130",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer over-read in bfd_getl16 function in peXXigen.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14529",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22113",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=4d465c689a8fb27212ef358d0aee89d60dee69a6",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=dcaaca89e8618eba35193c27afcb1cfa54f74582"
            ],
            "Description": "The pe_print_idata function in peXXigen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles HintName vector entries, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted PE file, related to the bfd_getl16 function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14529",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap buffer overflow in the *_get_synthetic_symtab functions",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14729",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22170",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=56933f9e3e90eebf1018ed7417d6c1184b91db6b",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360"
            ],
            "Description": "The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14729",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Integer overflow in the *_get_synthetic_symtab functions",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14745",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22148"
            ],
            "Description": "The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14745",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Memory leak in decode_line_info",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14930",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22191"
            ],
            "Description": "Memory leak in decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14930",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Infinite loop in the decode_line_info",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14932",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22204",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e338894dc2e603683bed2172e8e9f25b29051005"
            ],
            "Description": "decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14932",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Infinite loop in read_formatted_entries",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101203",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14933",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22210",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=30d0157a2ad64e64e5ff9fcc0dbe78a3e682f573",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=33e0a9a056bd23e923b929a4f2ab049ade0b1c32"
            ],
            "Description": "read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14933",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Infinite loop in process_debug_info",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101204",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14934",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22219",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=19485196044b2521af979f1e5c4a89bfb90fba0b"
            ],
            "Description": "process_debug_info in dwarf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite loop) via a crafted ELF file that contains a negative size value in a CU structure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14934",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Excessive memory allocation in _bfd_elf_slurp_version_tables",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101212",
              "https://blogs.gentoo.org/ago/2017/09/26/binutils-memory-allocation-failure-in-_bfd_elf_slurp_version_tables-elf-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14938",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22166",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=bd61e135492ecf624880e6b78e5fcde3c9716df6"
            ],
            "Description": "_bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14938",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in the decode_line_info",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101216",
              "https://blogs.gentoo.org/ago/2017/09/26/binutils-heap-based-buffer-overflow-in-read_1_byte-dwarf2-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14939",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22169",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=515f23e63c0074ab531bc954f84ca40c6281a724",
              "https://www.exploit-db.com/exploits/42970/"
            ],
            "Description": "decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles a length calculation, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to read_1_byte.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14939",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the scan_unit_for_symbols",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/09/26/binutils-null-pointer-dereference-in-scan_unit_for_symbols-dwarf2-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14940",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22166",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0d76029f92182c3682d8be2c833d45bc9a2068fe"
            ],
            "Description": "scan_unit_for_symbols in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14940",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the *_get_synthetic_symtab functions",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14974",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22163",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=e70c19e3a4c26e9c1ebf0c9170d105039b56d7cf"
            ],
            "Description": "The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandle the failure of a certain canonicalization step, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14974",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer overflow in parse_die",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15020",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22202",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5"
            ],
            "Description": "dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15020",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in bfd_get_debug_link_info_1",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-bfd_getl32-opncls-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15021",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22197",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=52b36c51e5bf6d7600fdc6ba115b170b0e78e31d"
            ],
            "Description": "bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15021",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in dwarf2.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-bfd_hash_hash-hash-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15022",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22201",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=11855d8a1f11b102a702ab76e95b22082cccf2f8"
            ],
            "Description": "dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15022",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in read_formatted_entries",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101611",
              "https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15023",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22200",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c361faae8d964db951b7100cada4dcdc983df1bf"
            ],
            "Description": "read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15023",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Infinite recursion in find_abstract_instance_name",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/10/03/binutils-infinite-loop-in-find_abstract_instance_name-dwarf2-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15024",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22187",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=52a93b95ec0771c97e26f0bb28630a271a667bd2"
            ],
            "Description": "find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15024",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Divide-by-zero in decode_line_info",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/10/03/binutils-divide-by-zero-in-decode_line_info-dwarf2-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15025",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22186",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d8010d3e75ec7194a4703774090b27486b742d48"
            ],
            "Description": "decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15025",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Memory leak in _bfd_dwarf2_cleanup_debug_info",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15225",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22212",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b55ec8b676ed05d93ee49d6c79ae0403616c4fb0"
            ],
            "Description": "_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (memory leak) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15225",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Invalid memory read in find_abstract_instance_name",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101610",
              "https://blogs.gentoo.org/ago/2017/10/24/binutils-invalid-memory-read-in-find_abstract_instance_name-dwarf2-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15938",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22209",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1b86808a86077722ee4f42ff97f836b12420bb2a"
            ],
            "Description": "dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, miscalculates DW_FORM_ref_addr die refs in the case of a relocatable object file, which allows remote attackers to cause a denial of service (find_abstract_instance_name invalid memory read, segmentation fault, and application crash).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15938",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the concat_filename",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101613",
              "https://blogs.gentoo.org/ago/2017/10/24/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c-incomplete-fix-for-cve-2017-15023/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15939",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22205",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a54018b72d75abf2e74bf36016702da06399c1d9"
            ],
            "Description": "dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles NULL files in a .debug_line file table, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. NOTE: this issue is caused by an incomplete fix for CVE-2017-15023.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15939",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Excessive memory allocation in elfcomm.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101608",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15996",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22361",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d91f0b20e561e326ee91a09a76206257bde8438b"
            ],
            "Description": "elfcomm.c in readelf in GNU Binutils 2.29 allows remote attackers to cause a denial of service (excessive memory allocation) or possibly have unspecified other impact via a crafted ELF file that triggers a \"buffer overflow on fuzzed archive header,\" related to an uninitialized variable, an improper conditional jump, and the get_archive_member_name, process_archive_index_and_symbols, and setup_archive functions.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15996",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Invalid memory access in the coff_slurp_line_table function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16826",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22376",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a67d66eb97e7613a38ffe6622d837303b3ecd31d"
            ],
            "Description": "The coff_slurp_line_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted PE file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16826",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Invalid free in the aout_get_external_symbols function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16827",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22306",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0301ce1486b1450f219202677f30d0fa97335419"
            ],
            "Description": "The aout_get_external_symbols function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (slurp_symtab invalid free and application crash) or possibly have unspecified other impact via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16827",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Integer overflow in the display_debug_frames function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16828",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22386",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=bf59c5d5f4f5b8b4da1f5f605cfa546f8029b43d"
            ],
            "Description": "The display_debug_frames function in dwarf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (integer overflow and heap-based buffer over-read, and application crash) or possibly have unspecified other impact via a crafted ELF file, related to print_debug_frame.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16828",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in the _bfd_elf_parse_gnu_properties function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16829",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22307",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=cf54ebff3b7361989712fd9c0128a9b255578163"
            ],
            "Description": "The _bfd_elf_parse_gnu_properties function in elf-properties.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not prevent negative pointers, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16829",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Segmentation fault in the print_gnu_property_note function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101941",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16830",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22384",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6ab2c4ed51f9c4243691755e1b1d2149c6a426f4"
            ],
            "Description": "The print_gnu_property_note function in readelf.c in GNU Binutils 2.29.1 does not have integer-overflow protection on 32-bit platforms, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16830",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Integer overflow in coffgen.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16831",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22385",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=6cee897971d4d7cd37d2a686bb6d2aa3e759c8ca"
            ],
            "Description": "coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate the symbol count, which allows remote attackers to cause a denial of service (integer overflow and application crash, or excessive memory allocation) or possibly have unspecified other impact via a crafted PE file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16831",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Segmentation fault in the pe_bfd_read_buildid function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16832",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22373",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0bb6961f18b8e832d88b490d421ca56cea16c45b"
            ],
            "Description": "The pe_bfd_read_buildid function in peicode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate size and offset values in the data dictionary, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via a crafted PE file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16832",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in bfd_getl32",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17080",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22421"
            ],
            "Description": "elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not validate sizes of core notes, which allows remote attackers to cause a denial of service (bfd_getl32 heap-based buffer over-read and application crash) via a crafted object file, related to elfcore_grok_netbsd_procinfo, elfcore_grok_openbsd_procinfo, and elfcore_grok_nto_status.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17080",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Memory access violation via a crafted COFF binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22506",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b23dc97fe237a1d9e850d7cbeee066183a00630b"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (memory access violation) or possibly have unspecified other impact via a COFF binary in which a relocation refers to a location after the end of the to-be-relocated section.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17121",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Excessive memory allocation in the dump_relocs_in_section function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17122",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22508",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d785b7d4b877ed465d04072e17ca19d0f47d840f"
            ],
            "Description": "The dump_relocs_in_section function in objdump.c in GNU Binutils 2.29.1 does not check for reloc count integer overflows, which allows remote attackers to cause a denial of service (excessive memory allocation, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PE file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17122",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the coff_slurp_reloc_table function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17123",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22509",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=4581a1c7d304ce14e714b27522ebf3d0188d6543"
            ],
            "Description": "The coff_slurp_reloc_table function in coffcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted COFF based file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17123",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap buffer overflow in the _bfd_coff_read_string_table function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17124",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22507",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=b0029dce6867de1a2828293177b0e030d2f0f03c"
            ],
            "Description": "The _bfd_coff_read_string_table function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, does not properly validate the size of the external string table, which allows remote attackers to cause a denial of service (excessive memory consumption, or heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted COFF binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17124",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Buffer over-read in the _bfd_elf_get_symbol_version_string function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17125",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22443",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=160b1a618ad94988410dc81fce9189fcda5b7ff4"
            ],
            "Description": "nm.c and objdump.c in GNU Binutils 2.29.1 mishandle certain global symbols, which allows remote attackers to cause a denial of service (_bfd_elf_get_symbol_version_string buffer over-read and application crash) or possibly have unspecified other impact via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17125",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Invalid memory access in the load_debug_section function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17126",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22510",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f425ec6600b69e39eb605f3128806ff688137ea8"
            ],
            "Description": "The load_debug_section function in readelf.c in GNU Binutils 2.29.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via an ELF file that lacks section headers.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17126",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in readelf when processing corrupt RL78 binaries",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/16/8",
              "http://www.securityfocus.com/bid/97065",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6969",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21156"
            ],
            "Description": "readelf in GNU Binutils 2.28 is vulnerable to a heap-based buffer over-read while processing corrupt RL78 binaries. The vulnerability can trigger program crashes. It may lead to an information leak as well.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6969",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Null pointer dereference in dump_section_as_bytes function in readelf",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/96994",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7209",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21135"
            ],
            "Description": "The dump_section_as_bytes function in readelf in GNU Binutils 2.28 accesses a NULL pointer while reading section contents in a corrupt binary, leading to a program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7209",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-reads in objdump",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/96992",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7210",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21157"
            ],
            "Description": "objdump in GNU Binutils 2.28 is vulnerable to multiple heap-based buffer over-reads (of size 1 and size 8) while handling corrupt STABS enum type strings in a crafted object file, leading to program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7210",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Global buffer overflow when attempting to unget EOF character",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7223",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20898"
            ],
            "Description": "GNU assembler in GNU Binutils 2.28 is vulnerable to a global buffer overflow (of size 1) while attempting to unget an EOF character from the input stream, potentially leading to a program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7223",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Invalid write in find_nearest_line function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97277",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7224",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20892"
            ],
            "Description": "The find_nearest_line function in objdump in GNU Binutils 2.28 is vulnerable to an invalid write (of size 1) while disassembling a corrupt binary that contains an empty function name, leading to a program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7224",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Null pointer dereference and invalid write in find_nearest_line function in addr2line",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97275",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7225",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20891"
            ],
            "Description": "The find_nearest_line function in addr2line in GNU Binutils 2.28 does not handle the case where the main file name and the directory name are both empty, triggering a NULL pointer dereference and an invalid write, and leading to a program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7225",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer over-read in pe_ILF_object_p function in libbfd",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7226",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20905"
            ],
            "Description": "The pe_ILF_object_p function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a heap-based buffer over-read of size 4049 because it uses the strlen function instead of strnlen, leading to program crashes in several utilities such as addr2line, size, and strings. It could lead to information disclosure as well.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7226",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-based buffer overflow in ld due to missing null termination",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97209",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7227",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20906"
            ],
            "Description": "GNU linker (ld) in GNU Binutils 2.28 is vulnerable to a heap-based buffer overflow while processing a bogus input script, leading to a program crash. This relates to lack of '\\0' termination of a name field in ldlex.l.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7227",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in bfd_elf_final_link function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97217",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7299",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20908"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an invalid read (of size 8) because the code to emit relocs (bfd_elf_final_link function in bfd/elflink.c) does not check the format of the input file before trying to read the ELF reloc section header. The vulnerability leads to a GNU linker (ld) program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7299",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-buffer overflow in aout_link_add_symbols function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97219",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7300",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20909"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that is vulnerable to a heap-based buffer over-read (off-by-one) because of an incomplete check for invalid string offsets while loading symbols, leading to a GNU linker (ld) program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7300",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Off-by-one error in aout_link_add_symbols function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97218",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7301",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20924"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has an aout_link_add_symbols function in bfd/aoutx.h that has an off-by-one vulnerability because it does not carefully check the string offset. The vulnerability could lead to a GNU linker (ld) program crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7301",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in wap_std_reloc_out function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97216",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7302",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20921"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a swap_std_reloc_out function in bfd/aoutx.h that is vulnerable to an invalid read (of size 4) because of missing checks for relocs that could not be recognised. This vulnerability causes Binutils utilities like strip to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7302",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in find_link function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97213",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7303",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20922"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 4) because of missing a check (in the find_link function) for null headers before attempting to match them. This vulnerability causes Binutils utilities like strip to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7303",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in copy_special_section_fields function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97215",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7304",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20931"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read (of size 8) because of missing a check (in the copy_special_section_fields function) for an invalid sh_link field before attempting to follow it. This vulnerability causes Binutils utilities like strip to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7304",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in bfd_elf_final_link function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/04/05/binutils-two-null-pointer-dereference-in-elflink-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7614",
              "https://security.gentoo.org/glsa/201709-02"
            ],
            "Description": "elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a \"member access within null pointer\" undefined behavior issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an \"int main() {return 0;}\" program.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7614",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the _bfd_dwarf2_find_nearest_line function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21409"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 8 because of missing a check to determine whether symbols are NULL in the _bfd_dwarf2_find_nearest_line function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8392",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read due to wrong assumption for objcopy and strip",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8393",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21412"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to a global buffer over-read error because of an assumption made by code that runs for objcopy and strip, that SHT_REL/SHR_RELA sections are always named starting with a .rel/.rela prefix. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy and strip, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8393",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the _bfd_elf_large_com_section",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8394",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21414"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 4 due to NULL pointer dereferencing of _bfd_elf_large_com_section. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8394",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds write in the _bfd_generic_get_section_contents function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8395",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21431"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid write of size 8 because of missing a malloc() return-value check to see if memory had actually been allocated in the _bfd_generic_get_section_contents function. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objcopy, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8395",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in the existing reloc offset range tests",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8396",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21432"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 because the existing reloc offset range tests didn't catch small negative offsets less than the size of the reloc field. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8396",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read and write while processing binary containing reloc(s) with negative addresses",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8397",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21434"
            ],
            "Description": "The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, is vulnerable to an invalid read of size 1 and an invalid write of size 1 during processing of a corrupt binary containing reloc(s) with negative addresses. This vulnerability causes programs that conduct an analysis of binary programs using the libbfd library, such as objdump, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8397",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read while dumping the debug information from a corrupt binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8398",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21438"
            ],
            "Description": "dwarf.c in GNU Binutils 2.28 is vulnerable to an invalid read of size 1 during dumping of debug information from a corrupt binary. This vulnerability causes programs that conduct an analysis of binary programs, such as objdump and readelf, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8398",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Memory exhaustion in objdump via a crafted PE file",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8421",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21440"
            ],
            "Description": "The function coff_set_alignment_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, has a memory leak vulnerability which can cause memory exhaustion in objdump via a crafted PE file. Additional validation in dump_relocs_in_section in objdump.c can resolve this.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8421",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap-buffer overflow in the byte_get_little_endian",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/98589",
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9038",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f32ba72991d2406b21ab17edc234a2f3fa7fb23d"
            ],
            "Description": "GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to the byte_get_little_endian function in elfcomm.c, the get_unwind_section_word function in readelf.c, and ARM unwind information that contains invalid word offsets.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9038",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Memory consumption via many program headers",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/98580",
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9039",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=82156ab704b08b124d319c0decdbd48b3ca2dac5"
            ],
            "Description": "GNU Binutils 2.28 allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file with many program headers, related to the get_program_headers function in readelf.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9039",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in the process_mips_specific_function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/98579",
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9040",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7296a62a2a237f6b1ad8db8c38b090e9f592c8cf"
            ],
            "Description": "GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the process_mips_specific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9040",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap buffer overflow in the process_mips_specific function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/98598",
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9041",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=75ec1fdbb797a389e4fe4aaf2e15358a070dcc19",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c4ab9505b53cdc899506ed421fddb7e1f8faf7a3"
            ],
            "Description": "GNU Binutils 2.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to MIPS GOT mishandling in the process_mips_specific function in readelf.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9041",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Invalid variable type in readelf.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9042",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7296a62a2a237f6b1ad8db8c38b090e9f592c8cf"
            ],
            "Description": "readelf.c in GNU Binutils 2017-04-12 has a \"cannot be represented in type long\" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9042",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Shift exponent too large for type unsigned long in readelf.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/98591",
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9043",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ddef72cdc10d82ba011a7ff81cafbbd3466acf54"
            ],
            "Description": "readelf.c in GNU Binutils 2017-04-12 has a \"shift exponent too large for type unsigned long\" issue, which might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9043",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Out-of-bounds read in the print_symbol_for_build_attribute function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/98587",
              "https://blogs.gentoo.org/ago/2017/05/12/binutils-multiple-crashes/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9044"
            ],
            "Description": "The print_symbol_for_build_attribute function in readelf.c in GNU Binutils 2017-04-12 allows remote attackers to cause a denial of service (invalid read and SEGV) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9044",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Global buffer over-read in print_insn_score16 function while disassembling corrupt score binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99105",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9742",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21576",
              "https://www.exploit-db.com/exploits/42203/"
            ],
            "Description": "The score_opcodes function in opcodes/score7-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9742",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Global buffer over-read in print_insn_score32 function while disassembling corrupt score binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99106",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9743",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21577"
            ],
            "Description": "The print_insn_score32 function in opcodes/score7-dis.c:552 in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9743",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Address violation in sh_elf_set_mach_from_flags function when disassembling a corrupt SH binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99108",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21578"
            ],
            "Description": "The sh_elf_set_mach_from_flags function in bfd/elf32-sh.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9744",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap buffer over-read in _bfd_vms_slurp_etir function when handling VMS alpha binaries",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99109",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9745",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21579"
            ],
            "Description": "The _bfd_vms_slurp_etir function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9745",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap buffer over-read in disassemble_bytes function when disassembling a corrupt binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99117",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9746",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21580",
              "https://www.exploit-db.com/exploits/42199/"
            ],
            "Description": "The disassemble_bytes function in objdump.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of rae insns printing for this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9746",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack-based buffer over-read in ieee_archive_p function while disassembling corrupt IEEE binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99114",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9747",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21581",
              "https://www.exploit-db.com/exploits/42200/"
            ],
            "Description": "The ieee_archive_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9747",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack-based buffer over-read in ieee_object_p function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99110",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9748",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21582",
              "https://www.exploit-db.com/exploits/42202/"
            ],
            "Description": "The ieee_object_p function in bfd/ieee.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, might allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution. NOTE: this may be related to a compiler bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9748",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Global buffer over-read in *regs* macros when disassembling corrupt bfin binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99113",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9749",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21586",
              "https://www.exploit-db.com/exploits/42201/"
            ],
            "Description": "The *regs* macros in opcodes/bfin-dis.c in GNU Binutils 2.28 allow remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9749",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Global buffer over-read in opcodes/rx-decode.opc when disassembling a corrupt RX binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99118",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9750",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21587",
              "https://www.exploit-db.com/exploits/42198/"
            ],
            "Description": "opcodes/rx-decode.opc in GNU Binutils 2.28 lacks bounds checks for certain scale arrays, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9750",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack-based buffer over-read in opcodes/rl78-decode.opc when disassembling a corrupt RL78 binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99111",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21588"
            ],
            "Description": "opcodes/rl78-decode.opc in GNU Binutils 2.28 has an unbounded GETBYTE macro, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9751",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Heap buffer over-read in f_bfd_vms_get_value function when processing a corrupt Alpha VMA binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99122",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9752",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21589"
            ],
            "Description": "bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file in the _bfd_vms_get_value and _bfd_vms_slurp_etir functions during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9752",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Address violation in versados_mkobject function when disassembling a corrupt versados binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9753",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21591"
            ],
            "Description": "The versados_mkobject function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not initialize a certain data structure, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9753",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack-based buffer over-read in process_otr function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99125",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9754",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21591"
            ],
            "Description": "The process_otr function in bfd/versados.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, does not validate a certain offset, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9754",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Global buffer over-read in opcodes/i386-dis.c while checking invalid registers",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99124",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9755",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21594"
            ],
            "Description": "opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9755",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Address violation in aarch64_ext_ldst_reglist function when disassembling corrupt aarch64 binary",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9756",
              "https://security.gentoo.org/glsa/201801-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21595",
              "https://www.exploit-db.com/exploits/42204/"
            ],
            "Description": "The aarch64_ext_ldst_reglist function in opcodes/aarch64-dis.c in GNU Binutils 2.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by mishandling of this file during \"objdump -D\" execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9756",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: stack-based buffer over-read in getvalue function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99307",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9954",
              "https://security.gentoo.org/glsa/201709-02",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21670"
            ],
            "Description": "The getvalue function in tekhex.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted tekhex file, as demonstrated by mishandling within the nm program.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9954",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap buffer over-read in get_build_id function",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/99573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9955",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21665"
            ],
            "Description": "The get_build_id function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file in which a certain size field is larger than a corresponding data field, as demonstrated by mishandling within the objdump program.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9955",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: excessive memory consumption in demangle_template in cplus-dem.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/104539",
              "https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12698",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85454",
              "https://security.gentoo.org/glsa/201908-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23057",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the \"Create an array for saving the template argument values\" XNEWVEC call. This can occur during execution of objdump.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-12698",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer overflow in finish_stab in stabs.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/104540",
              "https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12699",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85454",
              "https://security.gentoo.org/glsa/201908-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23057",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-12699",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack Exhaustion in debug_write_type in debug.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/104541",
              "https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763102",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12700",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85454",
              "https://security.gentoo.org/glsa/201908-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23057",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-12700",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Uncontrolled Resource Consumption in remember_Ktype in cplus-dem.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1763101",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12934",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85453",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23059",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This can occur during execution of cxxfilt.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-12934",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer over-read in bfd_getl32 in libbfd.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17360",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23685",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executable objdump.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-17360",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in libiberty/cplus-dem.c:work_stuff_copy_to_from() via crafted input",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17794",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87350",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in work_stuff_copy_to_from when called from iterate_demangle_function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-17794",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack consumption problem caused by the cplus_demangle_type",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17985",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87335",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demangle_type function making recursive calls to itself in certain scenarios involving many 'P' characters.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-17985",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Integer overflow in cplus-dem.c:get_count() allows for denial of service",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/105689",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18483",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87602",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23767",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc called with the result of an integer-overflowing calculation) or possibly have unspecified other impact via a crafted string, as demonstrated by c++filt.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18483",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Stack exhaustion in cp-demangle.c allows for denial of service",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/105693",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18484",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87636",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there is a stack consumption problem caused by recursive stack frames: cplus_demangle_type, d_bare_function_type, d_function_type.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18484",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: heap-based buffer over-read in sec_merge_hash_lookup in merge.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/105754",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18605",
              "https://security.netapp.com/advisory/ntap-20190307-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23804",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=ab419ddbb2cdd17ca83618990f2cacf904ce1d61",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "A heap-based buffer over-read issue was discovered in the function sec_merge_hash_lookup in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, because _bfd_add_merge_section mishandles section merges when size is not a multiple of entsize. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18605",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in _bfd_add_merge_section in merge_strings function in merge.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/105754",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18606",
              "https://security.netapp.com/advisory/ntap-20190307-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23806",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=45a0eaf77022963d639d6d19871dbab7b79703fc",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the merge_strings function in merge.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in _bfd_add_merge_section when attempting to merge sections with large alignments. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18606",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: NULL pointer dereference in elf_link_input_bfd in elflink.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/105754",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18607",
              "https://security.netapp.com/advisory/ntap-20190307-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23805",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=102def4da826b3d9e169741421e5e67e8731909a",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in elf_link_input_bfd in elflink.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. There is a NULL pointer dereference in elf_link_input_bfd when used for finding STT_TLS symbols without any TLS section. A specially crafted ELF allows remote attackers to cause a denial of service, as demonstrated by ld.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18607",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Recursive Stack Overflow within function d_name, d_encoding, and d_local_name in cp-demangle.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18700",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87681",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions d_name(), d_encoding(), and d_local_name() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18700",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: infinite recursion in next_is_type_qual and cplus_demangle_type functions in cp-demangle.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18701",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=87675",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption vulnerability resulting from infinite recursion in the functions next_is_type_qual() and cplus_demangle_type() in cp-demangle.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via an ELF file, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18701",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Integer overflow due to the IS_CONTAINED_BY_LMA macro resulting in a denial of service",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/106144",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19932",
              "https://security.gentoo.org/glsa/201908-01",
              "https://security.netapp.com/advisory/ntap-20190221-0004/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23932",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=beab453223769279cc1cef68a1622ab8978641f7",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19932",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: memory leak in _bfd_generic_read_minisymbols function in syms.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/106142",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20002",
              "https://security.gentoo.org/glsa/201908-01",
              "https://security.netapp.com/advisory/ntap-20190221-0004/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23952",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c2f5dc30afa34696f2da0081c4ac50b958ecb0e9",
              "https://support.f5.com/csp/article/K62602089",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20002",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Memory leak in demangle_template function resulting in a denial of service",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20657.html",
              "http://linux.oracle.com/errata/ELSA-2019-3352.html",
              "http://www.securityfocus.com/bid/106444",
              "https://access.redhat.com/errata/RHSA-2019:3352",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20657",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539",
              "https://support.f5.com/csp/article/K62602089"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20657",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Integer overflow in elf_object_p function in elfcode.h",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/102821",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6323",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22746",
              "https://www.exploit-db.com/exploits/44035/"
            ],
            "Description": "The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6323",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Unchecked strnlen in opncls.c:bfd_get_debug_link_info_1() can allow lead to denial of service",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/103030",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6759",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22794"
            ],
            "Description": "The bfd_get_debug_link_info_1 function in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, has an unchecked strnlen operation. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6759",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out of bounds read in elf_parse_notes function in elf.c file in libbfd library",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html",
              "http://www.securityfocus.com/bid/103103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6872",
              "https://security.gentoo.org/glsa/201811-17",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22788",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commit;h=ef135d4314fd4c2d7da66b9d7b59af4a85b0f7e6"
            ],
            "Description": "The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (out-of-bounds read and segmentation violation) via a note with a large alignment.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6872",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read in gold/fileread.cc and elfcpp/elfcpp_file.h leads to denial of service",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-1010204.html",
              "http://linux.oracle.com/errata/ELSA-2020-1797.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010204",
              "https://security.netapp.com/advisory/ntap-20190822-0001/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=23765",
              "https://support.f5.com/csp/article/K05032915?utm_source=f5support&amp;utm_medium=RSS"
            ],
            "Description": "GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1010204",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: out-of-bounds read in setup_group in bfd/elf.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/108903",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12972",
              "https://security.gentoo.org/glsa/202007-39",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24689",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=890f750a3b053532a4b839a2dd6243076de12031",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. There is a heap-based buffer over-read in _bfd_doprnt in bfd.c because elf_object_p in elfcode.h mishandles an e_shstrndx section of type SHT_GROUP by omitting a trailing '\\0' character.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-12972",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: integer overflow in simple-object-elf.c leads to a heap-based buffer overflow",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html",
              "http://www.securityfocus.com/bid/109354",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14250",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924",
              "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20190822-0002/",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14250",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: denial of service via crafted ELF file",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17450",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20191024-0002/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25078",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17450",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c",
            "PkgName": "binutils",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17451.html",
              "http://linux.oracle.com/errata/ELSA-2020-1797.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17451",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20191024-0002/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25070",
              "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=336bfbeb1848f4b9558456fdcf283ee8a32d7fd1",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an integer overflow leading to a SEGV in _bfd_dwarf2_find_nearest_line in dwarf2.c, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17451",
            "InstalledVersion": "2.27-41.base.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "bzip2: heap use after free in bzip2recover",
            "PkgName": "bzip2-libs",
            "Severity": "LOW",
            "References": [
              "http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html",
              "http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html",
              "http://www.openwall.com/lists/oss-security/2016/06/20/1",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/91297",
              "http://www.securitytracker.com/id/1036132",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1319648",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3189",
              "https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3@%3Cjira.kafka.apache.org%3E",
              "https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260@%3Cjira.kafka.apache.org%3E",
              "https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301@%3Cjira.kafka.apache.org%3E",
              "https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E",
              "https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73@%3Cdev.kafka.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html",
              "https://marc.info/?l=oss-security&m=146642106322396&w=2",
              "https://seclists.org/bugtraq/2019/Aug/4",
              "https://seclists.org/bugtraq/2019/Jul/22",
              "https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc",
              "https://security.gentoo.org/glsa/201708-08",
              "https://usn.ubuntu.com/4038-1/",
              "https://usn.ubuntu.com/4038-2/",
              "https://usn.ubuntu.com/usn/usn-4038-1",
              "https://usn.ubuntu.com/usn/usn-4038-2"
            ],
            "Description": "Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-3189",
            "InstalledVersion": "1.0.6-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "bzip2: out-of-bounds write in function BZ2_decompress",
            "PkgName": "bzip2-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html",
              "http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html",
              "http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html",
              "https://bugs.launchpad.net/ubuntu/+source/bzip2/+bug/1834494",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900",
              "https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc",
              "https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html",
              "https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html",
              "https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html",
              "https://seclists.org/bugtraq/2019/Aug/4",
              "https://seclists.org/bugtraq/2019/Jul/22",
              "https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc",
              "https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4038-1/",
              "https://usn.ubuntu.com/4038-2/",
              "https://usn.ubuntu.com/4146-1/",
              "https://usn.ubuntu.com/4146-2/",
              "https://usn.ubuntu.com/usn/usn-4038-1",
              "https://usn.ubuntu.com/usn/usn-4038-2",
              "https://usn.ubuntu.com/usn/usn-4038-3",
              "https://usn.ubuntu.com/usn/usn-4038-4",
              "https://usn.ubuntu.com/usn/usn-4146-1",
              "https://usn.ubuntu.com/usn/usn-4146-2"
            ],
            "Description": "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-12900",
            "InstalledVersion": "1.0.6-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 6.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 8.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "coreutils: Non-privileged session can escape to the parent session in chroot",
            "PkgName": "coreutils",
            "Severity": "MEDIUM",
            "References": [
              "http://seclists.org/oss-sec/2016/q1/452",
              "http://www.openwall.com/lists/oss-security/2016/02/28/2",
              "http://www.openwall.com/lists/oss-security/2016/02/28/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781",
              "https://lore.kernel.org/patchwork/patch/793178/"
            ],
            "Description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2781",
            "InstalledVersion": "8.22-24.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.7,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 4.2,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "coreutils: race condition vulnerability in chown and chgrp",
            "PkgName": "coreutils",
            "Severity": "MEDIUM",
            "References": ["http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html"],
            "Description": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18018",
            "InstalledVersion": "8.22-24.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "coreutils: memory corruption flaw in parse_datetime()",
            "PkgName": "coreutils",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0029.html",
              "http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872",
              "http://debbugs.gnu.org/cgi/bugreport.cgi?msg=11;filename=date-tz-crash.patch;att=1;bug=16872",
              "http://debbugs.gnu.org/cgi/bugreport.cgi?msg=19;filename=coreutils-date-crash.patch;att=1;bug=16872",
              "http://secunia.com/advisories/62226",
              "http://ubuntu.com/usn/usn-2473-1",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:179",
              "http://www.openwall.com/lists/oss-security/2014/11/25/1",
              "http://www.openwall.com/lists/oss-security/2014/11/25/4",
              "http://www.openwall.com/lists/oss-security/2015/01/03/11",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766147",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9471",
              "https://security.gentoo.org/glsa/201612-22",
              "https://usn.ubuntu.com/usn/usn-2473-1"
            ],
            "Description": "The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted date string, as demonstrated by the \"--date=TZ=\"123\"345\" @1\" string to the touch or date command.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9471",
            "InstalledVersion": "8.22-24.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "coreutils: heap buffer overflow in sort(1) keycompare_mb()",
            "PkgName": "coreutils",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2015/05/15/1",
              "https://bugzilla.suse.com/show_bug.cgi?id=928749",
              "https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940"
            ],
            "Description": "The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-4041",
            "InstalledVersion": "8.22-24.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "coreutils: possible buffer overflow in keycompare_mb()",
            "PkgName": "coreutils",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2015/05/15/1",
              "https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940"
            ],
            "Description": "Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-4042",
            "InstalledVersion": "8.22-24.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.9,
                "V3Score": 7.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "cpio: improper input validation when writing tar header fields leads to unexpect tar generation",
            "PkgName": "cpio",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14866.html",
              "http://linux.oracle.com/errata/ELSA-2020-3908.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14866",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14866",
              "https://lists.gnu.org/archive/html/bug-cpio/2019-08/msg00003.html",
              "https://lists.gnu.org/archive/html/bug-cpio/2019-11/msg00000.html",
              "https://usn.ubuntu.com/usn/usn-4176-1"
            ],
            "Description": "In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths he did not have access to. Extracting those archives from a high-privilege user without carefully reviewing them may lead to the compromise of the system.",
            "FixedVersion": "2.11-28.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14866",
            "InstalledVersion": "2.11-27.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:P/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "cpio: directory traversal through symlinks",
            "PkgName": "cpio",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0080.html",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:066",
              "http://www.openwall.com/lists/oss-security/2015/01/07/5",
              "http://www.openwall.com/lists/oss-security/2015/01/18/7",
              "http://www.securityfocus.com/bid/71914",
              "http://www.ubuntu.com/usn/USN-2906-1",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1197",
              "https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html",
              "https://usn.ubuntu.com/usn/usn-2906-1"
            ],
            "Description": "cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1197",
            "InstalledVersion": "2.11-27.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "cpio: out of bounds write",
            "PkgName": "cpio",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2016/dsa-3483",
              "http://www.openwall.com/lists/oss-security/2016/01/19/4",
              "http://www.openwall.com/lists/oss-security/2016/01/22/4",
              "http://www.securityfocus.com/bid/82293",
              "http://www.securitytracker.com/id/1035067",
              "http://www.ubuntu.com/usn/USN-2906-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2037",
              "https://usn.ubuntu.com/usn/usn-2906-1"
            ],
            "Description": "The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2037",
            "InstalledVersion": "2.11-27.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 1.9,
                "V3Score": 4,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "cracklib: Stack-based buffer overflow when parsing large GECOS field",
            "PkgName": "cracklib",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00122.html",
              "http://seclists.org/oss-sec/2016/q3/290",
              "http://www.openwall.com/lists/oss-security/2016/08/16/2",
              "http://www.securityfocus.com/bid/92478",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00023.html",
              "https://security.gentoo.org/glsa/201612-25"
            ],
            "Description": "Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6318",
            "InstalledVersion": "2.9.0-11.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 1.9,
                "V3Score": 4,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "cracklib: Stack-based buffer overflow when parsing large GECOS field",
            "PkgName": "cracklib-dicts",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00122.html",
              "http://seclists.org/oss-sec/2016/q3/290",
              "http://www.openwall.com/lists/oss-security/2016/08/16/2",
              "http://www.securityfocus.com/bid/92478",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00023.html",
              "https://security.gentoo.org/glsa/201612-25"
            ],
            "Description": "Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) or gain privileges via a long GECOS field, involving longbuffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6318",
            "InstalledVersion": "2.9.0-11.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: DNS rebinding attacks via incorrect whitelist",
            "PkgName": "cups-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2017-18190.html",
              "http://linux.oracle.com/errata/ELSA-2020-3864.html",
              "https://bugs.chromium.org/p/project-zero/issues/detail?id=1048",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18190",
              "https://github.com/apple/cups/commit/afa80cb2b457bf8d64f775bed307588610476c41",
              "https://lists.debian.org/debian-lts-announce/2018/02/msg00023.html",
              "https://lists.debian.org/debian-lts-announce/2018/07/msg00003.html",
              "https://usn.ubuntu.com/3577-1/",
              "https://usn.ubuntu.com/usn/usn-3577-1"
            ],
            "Description": "A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS server (neither the OS nor the web browser is responsible for ensuring that localhost.localdomain is 127.0.0.1).",
            "FixedVersion": "1:1.6.3-51.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18190",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: Local privilege escalation to root due to insecure environment variable handling",
            "PkgName": "cups-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-4180.html",
              "http://linux.oracle.com/errata/ELSA-2020-1050.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4180",
              "https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html",
              "https://security.gentoo.org/glsa/201908-08",
              "https://support.apple.com/HT208849",
              "https://usn.ubuntu.com/3713-1/",
              "https://usn.ubuntu.com/usn/usn-3713-1",
              "https://www.debian.org/security/2018/dsa-4243"
            ],
            "Description": "In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.",
            "FixedVersion": "1:1.6.3-43.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-4180",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.9,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: Manipulation of cupsd.conf by a local attacker resulting in limited reads of arbitrary files as root",
            "PkgName": "cups-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-4181.html",
              "http://linux.oracle.com/errata/ELSA-2020-1050.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4181",
              "https://lists.debian.org/debian-lts-announce/2018/07/msg00014.html",
              "https://security.gentoo.org/glsa/201908-08",
              "https://support.apple.com/HT208849",
              "https://usn.ubuntu.com/3713-1/",
              "https://usn.ubuntu.com/usn/usn-3713-1",
              "https://www.debian.org/security/2018/dsa-4243"
            ],
            "Description": "In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.",
            "FixedVersion": "1:1.6.3-43.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-4181",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: Session cookie generated by the CUPS web interface is easy to guess",
            "PkgName": "cups-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/107785",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4300",
              "https://github.com/apple/cups/releases/tag/v2.2.10",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html",
              "https://usn.ubuntu.com/usn/usn-3842-1"
            ],
            "Description": "The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.",
            "FixedVersion": "1:1.6.3-43.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-4300",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: Invalid usernames handled in scheduler/ipp.c:add_job() allow remote attackers to cause a denial of service",
            "PkgName": "cups-libs",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18248",
              "https://github.com/apple/cups/commit/49fa4983f25b64ec29d548ffa3b9782426007df3",
              "https://github.com/apple/cups/issues/5143",
              "https://github.com/apple/cups/releases/tag/v2.2.6",
              "https://lists.debian.org/debian-lts-announce/2018/05/msg00018.html",
              "https://lists.debian.org/debian-lts-announce/2018/07/msg00003.html",
              "https://security.cucumberlinux.com/security/details.php?id=346",
              "https://usn.ubuntu.com/3713-1/",
              "https://usn.ubuntu.com/usn/usn-3713-1"
            ],
            "Description": "The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by remote attackers by sending print jobs with an invalid username, related to a D-Bus notification.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18248",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 3.5,
                "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: stack-buffer-overflow in libcups's asn1_get_type function",
            "PkgName": "cups-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-8675.html",
              "http://linux.oracle.com/errata/ELSA-2020-3864.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8675",
              "https://usn.ubuntu.com/usn/usn-4105-1"
            ],
            "Description": "No description is available for this CVE.",
            "FixedVersion": "1:1.6.3-51.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-8675",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 3.5,
                "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: stack-buffer-overflow in libcups's asn1_get_packed function",
            "PkgName": "cups-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-8696.html",
              "http://linux.oracle.com/errata/ELSA-2020-3864.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8696",
              "https://usn.ubuntu.com/usn/usn-4105-1"
            ],
            "Description": "No description is available for this CVE.",
            "FixedVersion": "1:1.6.3-51.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-8696",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c",
            "PkgName": "cups-libs",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-3898",
              "https://support.apple.com/en-us/HT211100",
              "https://usn.ubuntu.com/usn/usn-4340-1"
            ],
            "Description": "No description is available for this CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-3898",
            "InstalledVersion": "1:1.6.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: sensitive HTTP server headers also sent to proxies",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://curl.haxx.se/docs/adv_20150429.html",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743",
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html",
              "http://www.debian.org/security/2015/dsa-3240",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
              "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
              "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
              "http://www.securityfocus.com/bid/74408",
              "http://www.securitytracker.com/id/1032233",
              "http://www.ubuntu.com/usn/USN-2591-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3153",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10131",
              "https://support.apple.com/kb/HT205031",
              "https://usn.ubuntu.com/usn/usn-2591-1"
            ],
            "Description": "The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3153",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Cookie injection for other servers",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8615.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94096",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8615",
              "https://curl.haxx.se/CVE-2016-8615.patch",
              "https://curl.haxx.se/docs/adv_20161102A.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8615",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8615",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Out-of-bounds write via unchecked multiplication",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8617.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94097",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8617",
              "https://curl.haxx.se/CVE-2016-8617.patch",
              "https://curl.haxx.se/docs/adv_20161102C.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8617",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8617",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Double-free in curl_maprintf",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8618.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94098",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618",
              "https://curl.haxx.se/docs/adv_20161102D.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8618",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8618",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Double-free in krb5 code",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8619.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94100",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619",
              "https://curl.haxx.se/CVE-2016-8619.patch",
              "https://curl.haxx.se/docs/adv_20161102E.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8619",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8619",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Invalid URL parsing with '#'",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8624.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94103",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624",
              "https://curl.haxx.se/docs/adv_20161102J.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8624",
              "https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5@%3Ccommits.pulsar.apache.org%3E",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8624",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: IDNA 2003 makes curl use wrong host",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8625.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.securityfocus.com/bid/94107",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625",
              "https://curl.haxx.se/CVE-2016-8625.patch",
              "https://curl.haxx.se/docs/adv_20161102K.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8625",
              "https://security.gentoo.org/glsa/201701-47",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8625",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: FTP PWD response parser out of bounds read",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3992",
              "http://www.securityfocus.com/bid/101115",
              "http://www.securitytracker.com/id/1039509",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/673d0cd8.patch",
              "https://curl.haxx.se/docs/adv_20171004.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254",
              "https://security.gentoo.org/glsa/201712-04",
              "https://support.apple.com/HT208331",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000254",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: FTP wildcard out of bounds read",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://security.cucumberlinux.com/security/details.php?id=162",
              "http://www.securityfocus.com/bid/102057",
              "http://www.securitytracker.com/id/1039897",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/docs/adv_2017-ae72.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8817",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html",
              "https://security.gentoo.org/glsa/201712-04",
              "https://usn.ubuntu.com/usn/usn-3498-1",
              "https://usn.ubuntu.com/usn/usn-3498-2",
              "https://www.debian.org/security/2017/dsa-4051"
            ],
            "Description": "The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8817",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "wget: Information exposure in set_file_metadata function in xattr.c",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS",
              "http://linux.oracle.com/cve/CVE-2018-20483.html",
              "http://linux.oracle.com/errata/ELSA-2019-3701.html",
              "http://www.securityfocus.com/bid/106358",
              "https://access.redhat.com/errata/RHSA-2019:3701",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483",
              "https://security.gentoo.org/glsa/201903-08",
              "https://security.netapp.com/advisory/ntap-20190321-0002/",
              "https://twitter.com/marcan42/status/1077676739877232640",
              "https://usn.ubuntu.com/3943-1/",
              "https://usn.ubuntu.com/usn/usn-3943-1"
            ],
            "Description": "set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20483",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.3,
                "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: heap buffer overflow in function tftp_receive_packet()",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5482.html",
              "http://linux.oracle.com/errata/ELSA-2020-5562.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
              "https://curl.haxx.se/docs/CVE-2019-5482.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
              "https://seclists.org/bugtraq/2020/Feb/36",
              "https://security.gentoo.org/glsa/202003-29",
              "https://security.netapp.com/advisory/ntap-20191004-0003/",
              "https://security.netapp.com/advisory/ntap-20200416-0003/",
              "https://usn.ubuntu.com/usn/usn-4129-1",
              "https://usn.ubuntu.com/usn/usn-4129-2",
              "https://www.debian.org/security/2020/dsa-4633",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html"
            ],
            "Description": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
            "FixedVersion": "7.29.0-59.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5482",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Incorrect argument check can allow remote servers to overwrite local files",
            "PkgName": "curl",
            "Severity": "MEDIUM",
            "References": [
              "https://curl.haxx.se/docs/CVE-2020-8177.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177",
              "https://usn.ubuntu.com/usn/usn-4402-1"
            ],
            "Description": "A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is to file integrity.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8177",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V2Score": 4,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: NTLM credentials not-checked for proxy connection re-use",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://curl.haxx.se/docs/adv_20160127A.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.html",
              "http://lists.opensuse.org/opensuse-updates/2016-02/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2016-02/msg00044.html",
              "http://lists.opensuse.org/opensuse-updates/2016-02/msg00047.html",
              "http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html",
              "http://www.debian.org/security/2016/dsa-3455",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/82307",
              "http://www.securitytracker.com/id/1034882",
              "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.519965",
              "http://www.ubuntu.com/usn/USN-2882-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0755",
              "https://security.gentoo.org/glsa/201701-47",
              "https://support.apple.com/HT207170",
              "https://usn.ubuntu.com/usn/usn-2882-1"
            ],
            "Description": "The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-0755",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Case insensitive password comparison",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8616.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94094",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8616",
              "https://curl.haxx.se/CVE-2016-8616.patch",
              "https://curl.haxx.se/docs/adv_20161102B.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8616",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8616",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: curl_getdate out-of-bounds read",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8621.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94101",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8621",
              "https://curl.haxx.se/CVE-2016-8621.patch",
              "https://curl.haxx.se/docs/adv_20161102G.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8621",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8621",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: URL unescape heap overflow via integer truncation",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8622.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94105",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622",
              "https://curl.haxx.se/docs/adv_20161102H.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8622",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8622",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Use-after-free via shared cookies",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8623.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94106",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8623",
              "https://curl.haxx.se/CVE-2016-8623.patch",
              "https://curl.haxx.se/docs/adv_20161102I.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8623",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8623",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: printf floating point buffer overflow",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/95019",
              "http://www.securitytracker.com/id/1037515",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9586",
              "https://curl.haxx.se/docs/adv_20161221A.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9586",
              "https://github.com/curl/curl/commit/curl-7_51_0-162-g3ab3c16",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9586",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: TFTP sends more than buffer size",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2017/dsa-3992",
              "http://www.securityfocus.com/bid/100286",
              "http://www.securitytracker.com/id/1039118",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/docs/adv_20170809B.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100",
              "https://security.gentoo.org/glsa/201709-14",
              "https://support.apple.com/HT208221",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000100",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 2.4,
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: --write-out out of bounds read",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/docs/adv_20170403.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7407",
              "https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13",
              "https://security.gentoo.org/glsa/201709-14",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7407",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: TFTP receive heap buffer overflow in tftp_receive_packet() function",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5436.html",
              "http://linux.oracle.com/errata/ELSA-2020-1792.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html",
              "http://www.openwall.com/lists/oss-security/2019/09/11/6",
              "https://curl.haxx.se/docs/CVE-2019-5436.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/",
              "https://seclists.org/bugtraq/2020/Feb/36",
              "https://security.gentoo.org/glsa/202003-29",
              "https://security.netapp.com/advisory/ntap-20190606-0004/",
              "https://support.f5.com/csp/article/K55133295",
              "https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/usn/usn-3993-1",
              "https://usn.ubuntu.com/usn/usn-3993-2",
              "https://www.debian.org/security/2020/dsa-4633",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            ],
            "Description": "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.",
            "FixedVersion": "7.29.0-57.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5436",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 3.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Expired pointer dereference via multi API with `CURLOPT_CONNECT_ONLY` option set",
            "PkgName": "curl",
            "Severity": "LOW",
            "References": [
              "https://curl.haxx.se/docs/CVE-2020-8231.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231",
              "https://usn.ubuntu.com/usn/usn-4466-1",
              "https://usn.ubuntu.com/usn/usn-4466-2"
            ],
            "Description": "A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's multi API, and sets the `CURLOPT_CONNECT_ONLY` option, might experience libcurl using the wrong connection. The highest threat from this vulnerability is to data confidentiality.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8231",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "cyrus-sasl: denial of service in _sasl_add_string function",
            "PkgName": "cyrus-sasl-lib",
            "Severity": "MEDIUM",
            "References": [
              "http://seclists.org/fulldisclosure/2020/Jul/23",
              "http://seclists.org/fulldisclosure/2020/Jul/24",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19906",
              "https://github.com/cyrusimap/cyrus-sasl/issues/587",
              "https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/",
              "https://seclists.org/bugtraq/2019/Dec/42",
              "https://support.apple.com/kb/HT211288",
              "https://support.apple.com/kb/HT211289",
              "https://usn.ubuntu.com/4256-1/",
              "https://usn.ubuntu.com/usn/usn-4256-1",
              "https://www.debian.org/security/2019/dsa-4591",
              "https://www.openldap.org/its/index.cgi/Incoming?id=9123"
            ],
            "Description": "cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19906",
            "InstalledVersion": "2.1.26-23.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.6,
                "V3Score": 7.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass",
            "PkgName": "dbus",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-12749.html",
              "http://linux.oracle.com/errata/ELSA-2020-4032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00092.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00026.html",
              "http://www.openwall.com/lists/oss-security/2019/06/11/2",
              "http://www.securityfocus.com/bid/108751",
              "https://access.redhat.com/errata/RHSA-2019:1726",
              "https://access.redhat.com/errata/RHSA-2019:2868",
              "https://access.redhat.com/errata/RHSA-2019:2870",
              "https://access.redhat.com/errata/RHSA-2019:3707",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12749",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00005.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2CQF37O73VH2JDVX2ILX2KD2KLXLQOU/",
              "https://seclists.org/bugtraq/2019/Jun/16",
              "https://security.gentoo.org/glsa/201909-08",
              "https://usn.ubuntu.com/4015-1/",
              "https://usn.ubuntu.com/4015-2/",
              "https://usn.ubuntu.com/usn/usn-4015-1",
              "https://usn.ubuntu.com/usn/usn-4015-2",
              "https://www.debian.org/security/2019/dsa-4462",
              "https://www.openwall.com/lists/oss-security/2019/06/11/2"
            ],
            "Description": "dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.",
            "FixedVersion": "1:1.10.24-15.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-12749",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.9,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service via file descriptor leak",
            "PkgName": "dbus",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12049.html",
              "http://linux.oracle.com/errata/ELSA-2020-3014.html",
              "http://www.openwall.com/lists/oss-security/2020/06/04/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12049",
              "https://gitlab.freedesktop.org/dbus/dbus/-/issues/294",
              "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.10.30",
              "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.12.18",
              "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.13.16",
              "https://security.gentoo.org/glsa/202007-46",
              "https://usn.ubuntu.com/4398-1/",
              "https://usn.ubuntu.com/4398-2/",
              "https://usn.ubuntu.com/usn/usn-4398-1",
              "https://usn.ubuntu.com/usn/usn-4398-2"
            ],
            "Description": "An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.",
            "FixedVersion": "1:1.10.24-14.el7_8",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12049",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service flaw in dbus-daemon",
            "PkgName": "dbus",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0266.html",
              "http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=24c590703ca47eb71ddef453de43126b90954567",
              "http://lists.opensuse.org/opensuse-updates/2014-06/msg00042.html",
              "http://lists.opensuse.org/opensuse-updates/2014-07/msg00012.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://seclists.org/oss-sec/2014/q2/509",
              "http://secunia.com/advisories/59428",
              "http://secunia.com/advisories/59611",
              "http://secunia.com/advisories/59798",
              "http://www.debian.org/security/2014/dsa-2971",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.securityfocus.com/bid/67986",
              "https://bugs.freedesktop.org/show_bug.cgi?id=78979",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3477",
              "https://usn.ubuntu.com/usn/usn-2275-1"
            ],
            "Description": "The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3477",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service in file descriptor passing feature",
            "PkgName": "dbus",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0294.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://openwall.com/lists/oss-security/2014/07/02/4",
              "http://secunia.com/advisories/59611",
              "http://secunia.com/advisories/59798",
              "http://secunia.com/advisories/60236",
              "http://www.debian.org/security/2014/dsa-2971",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80163",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3532",
              "https://usn.ubuntu.com/usn/usn-2275-1"
            ],
            "Description": "dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3532",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service when forwarding invalid file descriptors",
            "PkgName": "dbus",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0294.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://openwall.com/lists/oss-security/2014/07/02/4",
              "http://secunia.com/advisories/59611",
              "http://secunia.com/advisories/59798",
              "http://secunia.com/advisories/60236",
              "http://www.debian.org/security/2014/dsa-2971",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
              "https://bugs.freedesktop.org/show_bug.cgi?id=79694",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80469",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3533",
              "https://usn.ubuntu.com/usn/usn-2275-1"
            ],
            "Description": "dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3533",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: heap-based buffer overflow flaw in file descriptor passing",
            "PkgName": "dbus",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=83622",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3635",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3635",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service by queuing or splitting file descriptors",
            "PkgName": "dbus",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=82820",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3636",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3636",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service by creating unkillable D-Bus connections",
            "PkgName": "dbus",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.openwall.com/lists/oss-security/2019/06/24/13",
              "http://www.openwall.com/lists/oss-security/2019/06/24/14",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80559",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3637",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3637",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service in method call handling",
            "PkgName": "dbus",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://secunia.com/advisories/61431",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=81053",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3638",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3638",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service flaw in incomplete connection handling",
            "PkgName": "dbus",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://secunia.com/advisories/61431",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80919",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3639",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3639",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service in dbus systemd activation",
            "PkgName": "dbus",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0071.html",
              "http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html",
              "http://www.debian.org/security/2015/dsa-3161",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2015/02/09/6",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0245",
              "https://usn.ubuntu.com/usn/usn-3116-1"
            ],
            "Description": "D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0245",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.6,
                "V3Score": 7.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: DBusServer DBUS_COOKIE_SHA1 authentication bypass",
            "PkgName": "dbus-libs",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-12749.html",
              "http://linux.oracle.com/errata/ELSA-2020-4032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00092.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00026.html",
              "http://www.openwall.com/lists/oss-security/2019/06/11/2",
              "http://www.securityfocus.com/bid/108751",
              "https://access.redhat.com/errata/RHSA-2019:1726",
              "https://access.redhat.com/errata/RHSA-2019:2868",
              "https://access.redhat.com/errata/RHSA-2019:2870",
              "https://access.redhat.com/errata/RHSA-2019:3707",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12749",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00005.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2CQF37O73VH2JDVX2ILX2KD2KLXLQOU/",
              "https://seclists.org/bugtraq/2019/Jun/16",
              "https://security.gentoo.org/glsa/201909-08",
              "https://usn.ubuntu.com/4015-1/",
              "https://usn.ubuntu.com/4015-2/",
              "https://usn.ubuntu.com/usn/usn-4015-1",
              "https://usn.ubuntu.com/usn/usn-4015-2",
              "https://www.debian.org/security/2019/dsa-4462",
              "https://www.openwall.com/lists/oss-security/2019/06/11/2"
            ],
            "Description": "dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass.",
            "FixedVersion": "1:1.10.24-15.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-12749",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.9,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service via file descriptor leak",
            "PkgName": "dbus-libs",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12049.html",
              "http://linux.oracle.com/errata/ELSA-2020-3014.html",
              "http://www.openwall.com/lists/oss-security/2020/06/04/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12049",
              "https://gitlab.freedesktop.org/dbus/dbus/-/issues/294",
              "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.10.30",
              "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.12.18",
              "https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.13.16",
              "https://security.gentoo.org/glsa/202007-46",
              "https://usn.ubuntu.com/4398-1/",
              "https://usn.ubuntu.com/4398-2/",
              "https://usn.ubuntu.com/usn/usn-4398-1",
              "https://usn.ubuntu.com/usn/usn-4398-2"
            ],
            "Description": "An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.",
            "FixedVersion": "1:1.10.24-14.el7_8",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12049",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service flaw in dbus-daemon",
            "PkgName": "dbus-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0266.html",
              "http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=24c590703ca47eb71ddef453de43126b90954567",
              "http://lists.opensuse.org/opensuse-updates/2014-06/msg00042.html",
              "http://lists.opensuse.org/opensuse-updates/2014-07/msg00012.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://seclists.org/oss-sec/2014/q2/509",
              "http://secunia.com/advisories/59428",
              "http://secunia.com/advisories/59611",
              "http://secunia.com/advisories/59798",
              "http://www.debian.org/security/2014/dsa-2971",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.securityfocus.com/bid/67986",
              "https://bugs.freedesktop.org/show_bug.cgi?id=78979",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3477",
              "https://usn.ubuntu.com/usn/usn-2275-1"
            ],
            "Description": "The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3477",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service in file descriptor passing feature",
            "PkgName": "dbus-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0294.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://openwall.com/lists/oss-security/2014/07/02/4",
              "http://secunia.com/advisories/59611",
              "http://secunia.com/advisories/59798",
              "http://secunia.com/advisories/60236",
              "http://www.debian.org/security/2014/dsa-2971",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80163",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3532",
              "https://usn.ubuntu.com/usn/usn-2275-1"
            ],
            "Description": "dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3532",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service when forwarding invalid file descriptors",
            "PkgName": "dbus-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0294.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://openwall.com/lists/oss-security/2014/07/02/4",
              "http://secunia.com/advisories/59611",
              "http://secunia.com/advisories/59798",
              "http://secunia.com/advisories/60236",
              "http://www.debian.org/security/2014/dsa-2971",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
              "https://bugs.freedesktop.org/show_bug.cgi?id=79694",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80469",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3533",
              "https://usn.ubuntu.com/usn/usn-2275-1"
            ],
            "Description": "dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3533",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: heap-based buffer overflow flaw in file descriptor passing",
            "PkgName": "dbus-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=83622",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3635",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3635",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service by queuing or splitting file descriptors",
            "PkgName": "dbus-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=82820",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3636",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3636",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service by creating unkillable D-Bus connections",
            "PkgName": "dbus-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.openwall.com/lists/oss-security/2019/06/24/13",
              "http://www.openwall.com/lists/oss-security/2019/06/24/14",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80559",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3637",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3637",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service in method call handling",
            "PkgName": "dbus-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://secunia.com/advisories/61431",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=81053",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3638",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3638",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service flaw in incomplete connection handling",
            "PkgName": "dbus-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0395.html",
              "http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00026.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00049.html",
              "http://secunia.com/advisories/61378",
              "http://secunia.com/advisories/61431",
              "http://www.debian.org/security/2014/dsa-3026",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2014/09/16/9",
              "http://www.securitytracker.com/id/1030864",
              "http://www.ubuntu.com/usn/USN-2352-1",
              "https://bugs.freedesktop.org/show_bug.cgi?id=80919",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3639",
              "https://usn.ubuntu.com/usn/usn-2352-1"
            ],
            "Description": "The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3639",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "dbus: denial of service in dbus systemd activation",
            "PkgName": "dbus-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0071.html",
              "http://lists.opensuse.org/opensuse-updates/2015-02/msg00066.html",
              "http://www.debian.org/security/2015/dsa-3161",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:176",
              "http://www.openwall.com/lists/oss-security/2015/02/09/6",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0245",
              "https://usn.ubuntu.com/usn/usn-3116-1"
            ],
            "Description": "D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0245",
            "InstalledVersion": "1:1.10.24-13.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lvm2: memory leak in vg_lookup in daemons/lvmetad/lvmetad-core.c",
            "PkgName": "device-mapper",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8991",
              "https://sourceware.org/git/?p=lvm2.git;a=commit;h=bcf9556b8fcd16ad8997f80cc92785f295c66701"
            ],
            "Description": "** DISPUTED ** vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8991",
            "InstalledVersion": "7:1.02.158-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lvm2: memory leak in vg_lookup in daemons/lvmetad/lvmetad-core.c",
            "PkgName": "device-mapper-event",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8991",
              "https://sourceware.org/git/?p=lvm2.git;a=commit;h=bcf9556b8fcd16ad8997f80cc92785f295c66701"
            ],
            "Description": "** DISPUTED ** vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8991",
            "InstalledVersion": "7:1.02.158-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lvm2: memory leak in vg_lookup in daemons/lvmetad/lvmetad-core.c",
            "PkgName": "device-mapper-event-libs",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8991",
              "https://sourceware.org/git/?p=lvm2.git;a=commit;h=bcf9556b8fcd16ad8997f80cc92785f295c66701"
            ],
            "Description": "** DISPUTED ** vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8991",
            "InstalledVersion": "7:1.02.158-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lvm2: memory leak in vg_lookup in daemons/lvmetad/lvmetad-core.c",
            "PkgName": "device-mapper-libs",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8991",
              "https://sourceware.org/git/?p=lvm2.git;a=commit;h=bcf9556b8fcd16ad8997f80cc92785f295c66701"
            ],
            "Description": "** DISPUTED ** vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8991",
            "InstalledVersion": "7:1.02.158-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 6.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 7.2,
                "V3Score": 6.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "dracut: Brute force attack on LUKS password decryption via initramfs",
            "PkgName": "dracut",
            "Severity": "MEDIUM",
            "References": [
              "http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html",
              "http://www.openwall.com/lists/oss-security/2016/11/14/13",
              "http://www.openwall.com/lists/oss-security/2016/11/15/1",
              "http://www.openwall.com/lists/oss-security/2016/11/15/4",
              "http://www.openwall.com/lists/oss-security/2016/11/16/6",
              "http://www.securityfocus.com/bid/94315",
              "https://access.redhat.com/articles/2786581",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4484",
              "https://gitlab.com/cryptsetup/cryptsetup/commit/ef8a7d82d8d3716ae9b58179590f7908981fa0cb"
            ],
            "Description": "The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4484",
            "InstalledVersion": "033-564.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: ext2fs_open2() missing first_meta_bg boundary check leading to heap buffer overflow (oCERT-015-002)",
            "PkgName": "e2fsprogs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0061.html",
              "http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:045",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.ocert.org/advisories/ocert-2015-002.html",
              "http://www.securityfocus.com/archive/1/534633/100/0/threaded",
              "http://www.securityfocus.com/bid/72520",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1187032",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/100740",
              "https://security.gentoo.org/glsa/201701-06",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0247",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write",
            "PkgName": "e2fsprogs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5094.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://seclists.org/bugtraq/2019/Sep/58",
              "https://security.gentoo.org/glsa/202003-05",
              "https://security.netapp.com/advisory/ntap-20200115-0002/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
              "https://usn.ubuntu.com/4142-1/",
              "https://usn.ubuntu.com/4142-2/",
              "https://usn.ubuntu.com/usn/usn-4142-1",
              "https://usn.ubuntu.com/usn/usn-4142-2",
              "https://www.debian.org/security/2019/dsa-4535"
            ],
            "Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5094",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c",
            "PkgName": "e2fsprogs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5188.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
              "https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973",
              "https://usn.ubuntu.com/4249-1/",
              "https://usn.ubuntu.com/usn/usn-4249-1"
            ],
            "Description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5188",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: potential buffer overflow in closefs() (incomplete CVE-2015-0247 fix)",
            "PkgName": "e2fsprogs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0088.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00006.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:068",
              "http://www.securityfocus.com/bid/72709",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1572",
              "https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73",
              "https://security.gentoo.org/glsa/201507-22",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1572",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: ext2fs_open2() missing first_meta_bg boundary check leading to heap buffer overflow (oCERT-015-002)",
            "PkgName": "e2fsprogs-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0061.html",
              "http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:045",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.ocert.org/advisories/ocert-2015-002.html",
              "http://www.securityfocus.com/archive/1/534633/100/0/threaded",
              "http://www.securityfocus.com/bid/72520",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1187032",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/100740",
              "https://security.gentoo.org/glsa/201701-06",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0247",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write",
            "PkgName": "e2fsprogs-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5094.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://seclists.org/bugtraq/2019/Sep/58",
              "https://security.gentoo.org/glsa/202003-05",
              "https://security.netapp.com/advisory/ntap-20200115-0002/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
              "https://usn.ubuntu.com/4142-1/",
              "https://usn.ubuntu.com/4142-2/",
              "https://usn.ubuntu.com/usn/usn-4142-1",
              "https://usn.ubuntu.com/usn/usn-4142-2",
              "https://www.debian.org/security/2019/dsa-4535"
            ],
            "Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5094",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c",
            "PkgName": "e2fsprogs-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5188.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
              "https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973",
              "https://usn.ubuntu.com/4249-1/",
              "https://usn.ubuntu.com/usn/usn-4249-1"
            ],
            "Description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5188",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: potential buffer overflow in closefs() (incomplete CVE-2015-0247 fix)",
            "PkgName": "e2fsprogs-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0088.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00006.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:068",
              "http://www.securityfocus.com/bid/72709",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1572",
              "https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73",
              "https://security.gentoo.org/glsa/201507-22",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1572",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in allocate_elf",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/22/2",
              "https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-allocate_elf-common-h/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10254",
              "https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahosted.org/message/EJWVY7TMRDEMWPAPNVU3V4MZYG5HANF2/",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10254",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in __libelf_set_rawdata_wrlock (elf_getdata.c)",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/22/1",
              "https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-__libelf_set_rawdata_wrlock-elf_getdata-c/",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1387584",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10255",
              "https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahosted.org/thread/Q4LE47FPEVRZANMV6JE2NMHYO4H5MHGJ/",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10255",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the handle_gnu_hash function",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "http://www.securityfocus.com/bid/98608",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7607",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7607",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the ebl_object_note_type_name function",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "http://www.securityfocus.com/bid/98609",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7608",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7608",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in elf_compress.c",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7609",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7609",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_group function",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7610",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7610",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_symtab_shndx function",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7611",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7611",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_sysv_hash function",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7612",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7612",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: elflint.c does not validate the number of sections and segments",
            "PkgName": "elfutils-default-yama-scope",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7613",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7613",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in allocate_elf",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/22/2",
              "https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-allocate_elf-common-h/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10254",
              "https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahosted.org/message/EJWVY7TMRDEMWPAPNVU3V4MZYG5HANF2/",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10254",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in __libelf_set_rawdata_wrlock (elf_getdata.c)",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/22/1",
              "https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-__libelf_set_rawdata_wrlock-elf_getdata-c/",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1387584",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10255",
              "https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahosted.org/thread/Q4LE47FPEVRZANMV6JE2NMHYO4H5MHGJ/",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10255",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the handle_gnu_hash function",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "http://www.securityfocus.com/bid/98608",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7607",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7607",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the ebl_object_note_type_name function",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "http://www.securityfocus.com/bid/98609",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7608",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7608",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in elf_compress.c",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7609",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7609",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_group function",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7610",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7610",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_symtab_shndx function",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7611",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7611",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_sysv_hash function",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7612",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7612",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: elflint.c does not validate the number of sections and segments",
            "PkgName": "elfutils-libelf",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7613",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7613",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in allocate_elf",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/22/2",
              "https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-allocate_elf-common-h/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10254",
              "https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahosted.org/message/EJWVY7TMRDEMWPAPNVU3V4MZYG5HANF2/",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The allocate_elf function in common.h in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted ELF file, which triggers a memory allocation failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10254",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in __libelf_set_rawdata_wrlock (elf_getdata.c)",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/03/22/1",
              "https://blogs.gentoo.org/ago/2016/11/04/elfutils-memory-allocation-failure-in-__libelf_set_rawdata_wrlock-elf_getdata-c/",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1387584",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10255",
              "https://lists.fedorahosted.org/archives/list/elfutils-devel@lists.fedorahosted.org/thread/Q4LE47FPEVRZANMV6JE2NMHYO4H5MHGJ/",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The __libelf_set_rawdata_wrlock function in elf_getdata.c in elfutils before 0.168 allows remote attackers to cause a denial of service (crash) via a crafted (1) sh_off or (2) sh_size ELF header value, which triggers a memory allocation failure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10255",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the handle_gnu_hash function",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "http://www.securityfocus.com/bid/98608",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-handle_gnu_hash-readelf-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7607",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The handle_gnu_hash function in readelf.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7607",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the ebl_object_note_type_name function",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "http://www.securityfocus.com/bid/98609",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-ebl_object_note_type_name-eblobjnotetypename-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7608",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The ebl_object_note_type_name function in eblobjnotetypename.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7608",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Memory allocation failure in elf_compress.c",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-__libelf_decompress-elf_compress-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7609",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "elf_compress.c in elfutils 0.168 does not validate the zlib compression factor, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7609",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_group function",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_group-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7610",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_group function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7610",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_symtab_shndx function",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_symtab_shndx-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7611",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_symtab_shndx function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7611",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: Heap-buffer overflow in the check_sysv_hash function",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-heap-based-buffer-overflow-in-check_sysv_hash-elflint-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7612",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "The check_sysv_hash function in elflint.c in elfutils 0.168 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7612",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "elfutils: elflint.c does not validate the number of sections and segments",
            "PkgName": "elfutils-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c",
              "https://blogs.gentoo.org/ago/2017/04/03/elfutils-memory-allocation-failure-in-xcalloc-xmalloc-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7613",
              "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
              "https://security.gentoo.org/glsa/201710-10",
              "https://usn.ubuntu.com/3670-1/",
              "https://usn.ubuntu.com/usn/usn-3670-1"
            ],
            "Description": "elflint.c in elfutils 0.168 does not validate the number of sections and the number of segments, which allows remote attackers to cause a denial of service (memory consumption) via a crafted ELF file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7613",
            "InstalledVersion": "0.176-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: Using XML_Parse before rand() results into non-random output",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://seclists.org/oss-sec/2016/q2/468",
              "http://www.debian.org/security/2016/dsa-3597",
              "http://www.openwall.com/lists/oss-security/2016/06/03/8",
              "http://www.openwall.com/lists/oss-security/2016/06/04/1",
              "http://www.securityfocus.com/bid/91483",
              "http://www.ubuntu.com/usn/USN-3010-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6702",
              "https://security.gentoo.org/glsa/201701-21",
              "https://source.android.com/security/bulletin/2016-11-01.html",
              "https://usn.ubuntu.com/usn/usn-3010-1",
              "https://usn.ubuntu.com/usn/usn-3013-1",
              "https://www.tenable.com/security/tns-2016-20"
            ],
            "Description": "Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2012-6702",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: internal entity expansion",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://openwall.com/lists/oss-security/2013/02/22/3",
              "http://securitytracker.com/id?1028213",
              "http://www.openwall.com/lists/oss-security/2013/04/12/6",
              "http://www.osvdb.org/90634",
              "http://www.securityfocus.com/bid/58233",
              "https://security.gentoo.org/glsa/201701-21"
            ],
            "Description": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-0340",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: Integer overflow leading to buffer overflow in XML_GetBuffer()",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-2716.html",
              "http://linux.oracle.com/errata/ELSA-2020-1011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00054.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2015-05/msg00036.html",
              "http://rhn.redhat.com/errata/RHSA-2015-0988.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1012.html",
              "http://www.debian.org/security/2015/dsa-3260",
              "http://www.debian.org/security/2015/dsa-3264",
              "http://www.mozilla.org/security/announce/2015/mfsa2015-54.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.securityfocus.com/bid/74611",
              "http://www.ubuntu.com/usn/USN-2602-1",
              "http://www.ubuntu.com/usn/USN-2603-1",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1140537",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716",
              "https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c",
              "https://security.gentoo.org/glsa/201605-06",
              "https://usn.ubuntu.com/usn/usn-2602-1",
              "https://usn.ubuntu.com/usn/usn-2603-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2015-54/",
              "https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7",
              "https://www.tenable.com/security/tns-2016-20"
            ],
            "Description": "Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.",
            "FixedVersion": "2.1.0-11.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2716",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: Undefined behavior and pointer overflows",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/91528",
              "http://www.ubuntu.com/usn/USN-3013-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1344251",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472",
              "https://security.gentoo.org/glsa/201701-21",
              "https://sourceforge.net/p/expat/code_git/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde",
              "https://usn.ubuntu.com/usn/usn-3013-1",
              "https://www.tenable.com/security/tns-2016-20"
            ],
            "Description": "The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4472",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.8,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: Little entropy used for hash initialization",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://seclists.org/oss-sec/2016/q2/468",
              "http://www.debian.org/security/2016/dsa-3597",
              "http://www.openwall.com/lists/oss-security/2016/06/04/4",
              "http://www.openwall.com/lists/oss-security/2016/06/04/5",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/91159",
              "http://www.ubuntu.com/usn/USN-3010-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300",
              "https://security.gentoo.org/glsa/201701-21",
              "https://source.android.com/security/bulletin/2016-11-01.html",
              "https://usn.ubuntu.com/usn/usn-3010-1",
              "https://usn.ubuntu.com/usn/usn-3013-1",
              "https://www.tenable.com/security/tns-2016-20"
            ],
            "Description": "The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-5300",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: Inifinite loop due to invalid XML in external entity",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3898",
              "http://www.openwall.com/lists/oss-security/2017/06/17/7",
              "http://www.securityfocus.com/bid/99276",
              "http://www.securitytracker.com/id/1039427",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233",
              "https://github.com/libexpat/libexpat/blob/master/expat/Changes",
              "https://libexpat.github.io/doc/cve-2017-9233/",
              "https://support.apple.com/HT208112",
              "https://support.apple.com/HT208113",
              "https://support.apple.com/HT208115",
              "https://support.apple.com/HT208144",
              "https://support.f5.com/csp/article/K03244804",
              "https://usn.ubuntu.com/usn/usn-3356-1",
              "https://usn.ubuntu.com/usn/usn-3356-2"
            ],
            "Description": "XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9233",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.8,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: large number of colons in input makes parser consume high amount of resources, leading to DoS",
            "PkgName": "expat",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20843.html",
              "http://linux.oracle.com/errata/ELSA-2020-3952.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.html",
              "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20843",
              "https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes",
              "https://github.com/libexpat/libexpat/issues/186",
              "https://github.com/libexpat/libexpat/pull/262",
              "https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00028.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK/",
              "https://seclists.org/bugtraq/2019/Jun/39",
              "https://security.gentoo.org/glsa/201911-08",
              "https://security.netapp.com/advisory/ntap-20190703-0001/",
              "https://support.f5.com/csp/article/K51011533",
              "https://usn.ubuntu.com/4040-1/",
              "https://usn.ubuntu.com/4040-2/",
              "https://usn.ubuntu.com/usn/usn-4040-1",
              "https://usn.ubuntu.com/usn/usn-4040-2",
              "https://www.debian.org/security/2019/dsa-4472",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).",
            "FixedVersion": "2.1.0-12.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20843",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "firefox: Possible integer overflow to fix inside XML_Parse in Expat",
            "PkgName": "expat",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/94337",
              "http://www.securitytracker.com/id/1037298",
              "http://www.securitytracker.com/id/1039427",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1274777",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063",
              "https://usn.ubuntu.com/usn/usn-3124-1",
              "https://www.debian.org/security/2017/dsa-3898",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/#CVE-2016-9063",
              "https://www.mozilla.org/security/advisories/mfsa2016-89/"
            ],
            "Description": "An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9063",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "expat: heap-based buffer over-read via crafted XML input",
            "PkgName": "expat",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-15903.html",
              "http://linux.oracle.com/errata/ELSA-2020-3952.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html",
              "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html",
              "http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html",
              "http://seclists.org/fulldisclosure/2019/Dec/23",
              "http://seclists.org/fulldisclosure/2019/Dec/26",
              "http://seclists.org/fulldisclosure/2019/Dec/27",
              "http://seclists.org/fulldisclosure/2019/Dec/30",
              "https://access.redhat.com/errata/RHSA-2019:3210",
              "https://access.redhat.com/errata/RHSA-2019:3237",
              "https://access.redhat.com/errata/RHSA-2019:3756",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15903",
              "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
              "https://github.com/libexpat/libexpat/issues/317",
              "https://github.com/libexpat/libexpat/issues/342",
              "https://github.com/libexpat/libexpat/pull/318",
              "https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html",
              "https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/",
              "https://seclists.org/bugtraq/2019/Dec/17",
              "https://seclists.org/bugtraq/2019/Dec/21",
              "https://seclists.org/bugtraq/2019/Dec/23",
              "https://seclists.org/bugtraq/2019/Nov/1",
              "https://seclists.org/bugtraq/2019/Nov/24",
              "https://seclists.org/bugtraq/2019/Oct/29",
              "https://seclists.org/bugtraq/2019/Sep/30",
              "https://seclists.org/bugtraq/2019/Sep/37",
              "https://security.gentoo.org/glsa/201911-08",
              "https://security.netapp.com/advisory/ntap-20190926-0004/",
              "https://support.apple.com/kb/HT210785",
              "https://support.apple.com/kb/HT210788",
              "https://support.apple.com/kb/HT210789",
              "https://support.apple.com/kb/HT210790",
              "https://support.apple.com/kb/HT210793",
              "https://support.apple.com/kb/HT210794",
              "https://support.apple.com/kb/HT210795",
              "https://usn.ubuntu.com/4132-1/",
              "https://usn.ubuntu.com/4132-2/",
              "https://usn.ubuntu.com/4165-1/",
              "https://usn.ubuntu.com/4202-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4132-1",
              "https://usn.ubuntu.com/usn/usn-4132-2",
              "https://usn.ubuntu.com/usn/usn-4165-1",
              "https://usn.ubuntu.com/usn/usn-4202-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.debian.org/security/2019/dsa-4530",
              "https://www.debian.org/security/2019/dsa-4549",
              "https://www.debian.org/security/2019/dsa-4571",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-15903",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.",
            "FixedVersion": "2.1.0-12.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-15903",
            "InstalledVersion": "2.1.0-10.el7_3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "file: limit the number of ELF notes processed",
            "PkgName": "file-libs",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0040.html",
              "http://linux.oracle.com/cve/CVE-2014-9620.html",
              "http://linux.oracle.com/errata/ELSA-2016-0760.html",
              "http://mx.gw.com/pipermail/file/2014/001653.html",
              "http://mx.gw.com/pipermail/file/2015/001660.html",
              "http://rhn.redhat.com/errata/RHSA-2016-0760.html",
              "http://www.debian.org/security/2015/dsa-3121",
              "http://www.openwall.com/lists/oss-security/2015/01/17/9",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/71715",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9620",
              "https://github.com/file/file/commit/ce90e05774dd77d86cfc8dfa6da57b32816841c4",
              "https://security.gentoo.org/glsa/201503-08",
              "https://usn.ubuntu.com/3686-1/",
              "https://usn.ubuntu.com/usn/usn-3686-1"
            ],
            "Description": "The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9620",
            "InstalledVersion": "5.11-35.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V3Score": 5.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "file: Buffer over-write in finfo_open with malformed magic file",
            "PkgName": "file-libs",
            "Severity": "LOW",
            "References": [
              "http://bugs.gw.com/view.php?id=522",
              "http://git.php.net/?p=php-src.git;a=commit;h=fe13566c93f118a15a96320a546c7878fd0cfc5e",
              "http://lists.apple.com/archives/security-announce/2016/May/msg00004.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://www.debian.org/security/2016/dsa-3560",
              "http://www.openwall.com/lists/oss-security/2016/04/11/7",
              "http://www.openwall.com/lists/oss-security/2016/04/24/1",
              "http://www.php.net/ChangeLog-5.php",
              "http://www.php.net/ChangeLog-7.php",
              "http://www.securityfocus.com/bid/85802",
              "http://www.ubuntu.com/usn/USN-2952-1",
              "http://www.ubuntu.com/usn/USN-2952-2",
              "https://bugs.php.net/bug.php?id=71527",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8865",
              "https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201611-22",
              "https://security.gentoo.org/glsa/201701-42",
              "https://support.apple.com/HT206567",
              "https://usn.ubuntu.com/3686-1/",
              "https://usn.ubuntu.com/3686-2/",
              "https://usn.ubuntu.com/usn/usn-2952-1",
              "https://usn.ubuntu.com/usn/usn-2984-1",
              "https://usn.ubuntu.com/usn/usn-3686-1",
              "https://usn.ubuntu.com/usn/usn-3686-2"
            ],
            "Description": "The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8865",
            "InstalledVersion": "5.11-35.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "file: out-of-bounds read via a crafted ELF file",
            "PkgName": "file-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-10360.html",
              "http://linux.oracle.com/errata/ELSA-2020-1022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10360",
              "https://github.com/file/file/commit/a642587a9c9e2dd7feacdf513c3643ce26ad3c22",
              "https://security.gentoo.org/glsa/201806-08",
              "https://usn.ubuntu.com/3686-1/",
              "https://usn.ubuntu.com/3686-2/",
              "https://usn.ubuntu.com/usn/usn-3686-1",
              "https://usn.ubuntu.com/usn/usn-3686-2"
            ],
            "Description": "The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.",
            "FixedVersion": "5.11-36.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-10360",
            "InstalledVersion": "5.11-35.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:P"
              },
              "redhat": {
                "V2Score": 7.2,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "fuse: incorrect filtering of environment variables leading to privilege escalation",
            "PkgName": "fuse",
            "Severity": "LOW",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159831.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160094.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160106.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00005.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00007.html",
              "http://packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html",
              "http://www.debian.org/security/2015/dsa-3266",
              "http://www.debian.org/security/2015/dsa-3268",
              "http://www.openwall.com/lists/oss-security/2015/05/21/9",
              "http://www.securityfocus.com/bid/74765",
              "http://www.securitytracker.com/id/1032386",
              "http://www.ubuntu.com/usn/USN-2617-1",
              "http://www.ubuntu.com/usn/USN-2617-2",
              "http://www.ubuntu.com/usn/USN-2617-3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202",
              "https://gist.github.com/taviso/ecb70eb12d461dd85cba",
              "https://security.gentoo.org/glsa/201603-04",
              "https://security.gentoo.org/glsa/201701-19",
              "https://twitter.com/taviso/status/601370527437967360",
              "https://usn.ubuntu.com/usn/usn-2617-1",
              "https://usn.ubuntu.com/usn/usn-2617-2",
              "https://usn.ubuntu.com/usn/usn-2617-3",
              "https://www.exploit-db.com/exploits/37089/"
            ],
            "Description": "fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3202",
            "InstalledVersion": "2.9.2-11.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:P"
              },
              "redhat": {
                "V2Score": 7.2,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "fuse: incorrect filtering of environment variables leading to privilege escalation",
            "PkgName": "fuse-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159298.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159543.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159683.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159831.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160094.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160106.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00005.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00007.html",
              "http://packetstormsecurity.com/files/132021/Fuse-Local-Privilege-Escalation.html",
              "http://www.debian.org/security/2015/dsa-3266",
              "http://www.debian.org/security/2015/dsa-3268",
              "http://www.openwall.com/lists/oss-security/2015/05/21/9",
              "http://www.securityfocus.com/bid/74765",
              "http://www.securitytracker.com/id/1032386",
              "http://www.ubuntu.com/usn/USN-2617-1",
              "http://www.ubuntu.com/usn/USN-2617-2",
              "http://www.ubuntu.com/usn/USN-2617-3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3202",
              "https://gist.github.com/taviso/ecb70eb12d461dd85cba",
              "https://security.gentoo.org/glsa/201603-04",
              "https://security.gentoo.org/glsa/201701-19",
              "https://twitter.com/taviso/status/601370527437967360",
              "https://usn.ubuntu.com/usn/usn-2617-1",
              "https://usn.ubuntu.com/usn/usn-2617-2",
              "https://usn.ubuntu.com/usn/usn-2617-3",
              "https://www.exploit-db.com/exploits/37089/"
            ],
            "Description": "fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3202",
            "InstalledVersion": "2.9.2-11.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30)",
            "PkgName": "glib2",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-8385.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/85572",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8385",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the /(?|(\\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8385",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: workspace overflow for (*ACCEPT) with deeply nested parentheses (8.39/13, 10.22/12)",
            "PkgName": "glib2",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-3191.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://vcs.pcre.org/pcre2?view=revision&revision=489",
              "http://vcs.pcre.org/pcre?view=revision&revision=1631",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/84810",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://bugs.debian.org/815920",
              "https://bugs.debian.org/815921",
              "https://bugs.exim.org/show_bug.cgi?id=1791",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1311503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3191",
              "https://usn.ubuntu.com/usn/usn-2943-1",
              "https://www.tenable.com/security/tns-2016-18"
            ],
            "Description": "The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-3191",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: infinite recursion compiling pattern with zero-repeated groups that include recursive back reference (8.36/19)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.fortiguard.com/advisory/FG-VD-15-010/",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/74924",
              "https://bugs.exim.org/show_bug.cgi?id=1503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2327",
              "https://jira.mongodb.org/browse/SERVER-17252",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.36 mishandles the /(((a\\2)|(a*)\\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2327",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: infinite recursion compiling pattern with recursive reference in a group with indefinite repeat (8.36/20)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-2328.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.fortiguard.com/advisory/FG-VD-15-014/",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/74924",
              "https://bugs.exim.org/show_bug.cgi?id=1515",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2328",
              "https://jira.mongodb.org/browse/SERVER-17252",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2328",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: stack overflow caused by mishandled group empty match (8.38/11)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-3217.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre?view=revision&revision=1566",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.openwall.com/lists/oss-security/2015/06/03/7",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/75018",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bugs.exim.org/show_bug.cgi?id=1638",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1228283",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3217"
            ],
            "Description": "PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3217",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-5073.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609&view=markup",
              "http://vcs.pcre.org/pcre?view=revision&revision=1571",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.openwall.com/lists/oss-security/2015/06/26/1",
              "http://www.openwall.com/lists/oss-security/2015/06/26/3",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/75430",
              "http://www.securitytracker.com/id/1033154",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bugs.exim.org/show_bug.cgi?id=1651",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5073",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2694-1",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5073",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: Integer overflow in subroutine calls (8.38/8)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8387",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8387",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "CVE-2015-5073 CVE-2015-8388 pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-8388.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/85576",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8388",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8388",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: uninitialized memory read triggered by malformed posix character class (8.38/22)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8390",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the [: and \\\\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8390",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 9,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:C"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: inefficient posix character class syntax check (8.38/16)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-8391.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/82990",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8391",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8391",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: Integer overflow caused by missing check for certain conditions (8.38/31)",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8394",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8394",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.6,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-12450.html",
              "http://linux.oracle.com/errata/ELSA-2020-3978.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.html",
              "https://access.redhat.com/errata/RHSA-2019:3530",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12450",
              "https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00013.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/",
              "https://security.netapp.com/advisory/ntap-20190606-0003/",
              "https://usn.ubuntu.com/4014-1/",
              "https://usn.ubuntu.com/4014-2/",
              "https://usn.ubuntu.com/usn/usn-4014-1",
              "https://usn.ubuntu.com/usn/usn-4014-2"
            ],
            "Description": "file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.",
            "FixedVersion": "2.56.1-7.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-12450",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.6,
                "V3Score": 7.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "ibus: missing authorization allows local attacker to access the input bus of another user",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14822.html",
              "http://linux.oracle.com/errata/ELSA-2020-3978.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1717958",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14822",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14822",
              "https://usn.ubuntu.com/4134-3/",
              "https://usn.ubuntu.com/usn/usn-4134-1",
              "https://usn.ubuntu.com/usn/usn-4134-2",
              "https://usn.ubuntu.com/usn/usn-4134-3",
              "https://www.openwall.com/lists/oss-security/2019/09/13/1"
            ],
            "Description": "A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical interface, change the input method engine, or modify other input related configurations of the victim user.",
            "FixedVersion": "2.56.1-7.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14822",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 8.2,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glib: g_socket_client_connected_callback in gio/gsocketclient.c allows to cause denial of service",
            "PkgName": "glib2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/107391",
              "https://gitlab.gnome.org/GNOME/glib/issues/1649"
            ],
            "Description": "gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which allows remote attackers to cause a denial of service (g_socket_client_connected_callback mishandling and application crash) via a crafted web site, as demonstrated by GNOME Web (aka Epiphany).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9633",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: Buffer overflow caused by lookbehind assertion (8.38/6)",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-8386.html",
              "http://linux.oracle.com/errata/ELSA-2016-1025.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1025.html",
              "http://rhn.redhat.com/errata/RHSA-2016-2750.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "http://www.securityfocus.com/bid/82990",
              "https://access.redhat.com/errata/RHSA-2016:1132",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8386",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8386",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.8,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: OP_KETRMAX feature in the match function in pcre_exec.c",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2017/07/11/3",
              "http://www.securityfocus.com/bid/99575",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164"
            ],
            "Description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11164",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c)",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97067",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/20/libpcre-invalid-memory-read-in-_pcre32_xclass-pcre_xclass-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7244",
              "https://security.gentoo.org/glsa/201710-25"
            ],
            "Description": "The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7244",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: stack-based buffer overflow write in pcre32_copy_substring",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97067",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/",
              "https://security.gentoo.org/glsa/201710-25"
            ],
            "Description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7245",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pcre: stack-based buffer overflow write in pcre32_copy_substring",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97067",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/",
              "https://security.gentoo.org/glsa/201710-25"
            ],
            "Description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7246",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.1,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glib2: NULL pointer dereference in g_markup_parse_context_end_parse() function in gmarkup.c",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2020/02/14/3",
              "http://www.securityfocus.com/bid/105210",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16428",
              "https://gitlab.gnome.org/GNOME/glib/commit/fccef3cc822af74699cca84cd202719ae61ca3b9",
              "https://gitlab.gnome.org/GNOME/glib/issues/1364",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html",
              "https://usn.ubuntu.com/3767-1/",
              "https://usn.ubuntu.com/3767-2/",
              "https://usn.ubuntu.com/usn/usn-3767-1",
              "https://usn.ubuntu.com/usn/usn-3767-2"
            ],
            "Description": "In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-16428",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.6,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glib2: Out-of-bounds read in g_markup_parse_context_parse() in gmarkup.c",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16429",
              "https://gitlab.gnome.org/GNOME/glib/commit/cec71705406f0b2790422f0c1aa0ff3b4b464b1b",
              "https://gitlab.gnome.org/GNOME/glib/issues/1361",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html",
              "https://usn.ubuntu.com/3767-1/",
              "https://usn.ubuntu.com/3767-2/",
              "https://usn.ubuntu.com/usn/usn-3767-1",
              "https://usn.ubuntu.com/usn/usn-3767-2"
            ],
            "Description": "GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-16429",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glib2: insecure permissions for files and directories",
            "PkgName": "glib2",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00022.html",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931234#12",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13012",
              "https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429",
              "https://gitlab.gnome.org/GNOME/glib/issues/1658",
              "https://gitlab.gnome.org/GNOME/glib/merge_requests/450",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00004.html",
              "https://security.netapp.com/advisory/ntap-20190806-0003/",
              "https://usn.ubuntu.com/4049-1/",
              "https://usn.ubuntu.com/4049-2/",
              "https://usn.ubuntu.com/usn/usn-4049-1",
              "https://usn.ubuntu.com/usn/usn-4049-2",
              "https://usn.ubuntu.com/usn/usn-4049-3",
              "https://usn.ubuntu.com/usn/usn-4049-4"
            ],
            "Description": "The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13012",
            "InstalledVersion": "2.56.1-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: parse_reg_exp in posix/regcomp.c misparses alternatives leading to denial of service or trigger incorrect result",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5155",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238",
              "https://security.netapp.com/advisory/ntap-20190315-0002/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=11053",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=18986",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672",
              "https://support.f5.com/csp/article/K64119434",
              "https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp;utm_medium=RSS"
            ],
            "Description": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2009-5155",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: _IO_wstr_overflow integer overflow",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/02/22/15",
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/72740",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8983",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=17269",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bdf1ff052a8e23d637f2c838fa5642d78fcedc33",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html"
            ],
            "Description": "Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8983",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.6,
                "V3Score": 4.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: Stack-based buffer overflow in glob with GLOB_ALTDIRFUNC and crafted directory",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html",
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html",
              "http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html",
              "http://www.openwall.com/lists/oss-security/2016/03/07/16",
              "http://www.securityfocus.com/bid/84204",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1234",
              "https://security.gentoo.org/glsa/201702-11",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=19779",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5171f3079f2cc53e0548fc4967361f4d1ce9d7ea",
              "https://usn.ubuntu.com/usn/usn-3239-1"
            ],
            "Description": "Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1234",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html",
              "http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
              "http://www.securityfocus.com/bid/102073",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4429",
              "https://lists.debian.org/debian-lts-announce/2020/06/msg00027.html",
              "https://source.android.com/security/bulletin/2017-12-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20112",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bc779a1a5b3035133024b21e2f339fe4219fb11c",
              "https://usn.ubuntu.com/3759-1/",
              "https://usn.ubuntu.com/3759-2/",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://usn.ubuntu.com/usn/usn-3759-1",
              "https://usn.ubuntu.com/usn/usn-3759-2"
            ],
            "Description": "Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4429",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.8,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: memory leak in sunrpc when decoding malformed XDR",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00026.html",
              "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00049.html",
              "http://www.openwall.com/lists/oss-security/2017/05/05/2",
              "http://www.securityfocus.com/bid/98339",
              "https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7",
              "https://seclists.org/oss-sec/2017/q2/228",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21461",
              "https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00128.html",
              "https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00129.html",
              "https://sourceware.org/ml/libc-alpha/2017-05/msg00105.html"
            ],
            "Description": "** DISPUTED ** The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references]",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8804",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: stack guard protection bypass",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": ["https://sourceware.org/bugzilla/show_bug.cgi?id=22850"],
            "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1010022",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/107160",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10278",
              "https://security.gentoo.org/glsa/202006-04",
              "https://security.netapp.com/advisory/ntap-20190315-0002/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24114",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9",
              "https://support.f5.com/csp/article/K54823184",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9169",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10029",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E/",
              "https://security.gentoo.org/glsa/202006-04",
              "https://security.netapp.com/advisory/ntap-20200327-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25487",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=9333498794cde1d5cca518badf79533a24114b6f",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10029",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.7,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: use-after-free in glob() function when expanding ~user",
            "PkgName": "glibc",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1752",
              "https://security.netapp.com/advisory/ntap-20200511-0005/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25414",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ddc650e9b3dc916eab417ce9f79e67337b05035c",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1752",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 1,
                "V2Vector": "AV:L/AC:H/Au:S/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: posix_spawn_file_actions_addopen fails to copy the path argument",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00012.html",
              "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
              "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
              "http://seclists.org/fulldisclosure/2019/Jun/18",
              "http://seclists.org/fulldisclosure/2019/Sep/7",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2014:152",
              "http://www.openwall.com/lists/oss-security/2014/06/13/2",
              "http://www.securityfocus.com/bid/68006",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1109263",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/93784",
              "https://seclists.org/bugtraq/2019/Jun/14",
              "https://seclists.org/bugtraq/2019/Sep/7",
              "https://security.gentoo.org/glsa/201503-04",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=17048",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blobdiff;f=ChangeLog;h=3020b9ac232315df362521aeaf85f21cb9926db8;hp=d86e73963dd9fb5e21b1a28326630337226812aa;hb=89e435f3559c53084498e9baad22172b64429362;hpb=c3a2ebe1f7541cc35937621e08c28ff88afd0845",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blobdiff;f=posix/spawn_faction_addopen.c;h=40800b8e6e81341501c0fb8a91009529e2048dec;hp=47f62425b696a4fdd511b2a057746322eb6518db;hb=89e435f3559c53084498e9baad22172b64429362;hpb=c3a2ebe1f7541cc35937621e08c28ff88afd0845",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=89e435f3559c53084498e9baad22172b64429362",
              "https://usn.ubuntu.com/usn/usn-2306-1"
            ],
            "Description": "The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-4043",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: multiple overflows in strxfrm()",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2015/09/08/2",
              "http://www.openwall.com/lists/oss-security/2015/02/13/3",
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/72602",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8982",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=16009",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=0f9e585480ed",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0f9e585480ed",
              "https://usn.ubuntu.com/usn/usn-3239-1"
            ],
            "Description": "Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8982",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: potential denial of service in internal_fnmatch()",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/02/26/5",
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/72789",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8984",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=18032",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4a28f4d55a6cc33474c0792fe93b5942d81bf185",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html"
            ],
            "Description": "The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8984",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: potential denial of service in pop_fail_stack()",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/76916",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8985",
              "https://security.gentoo.org/glsa/201908-06"
            ],
            "Description": "The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8985",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: iconv program can hang when invoked with the -c option",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2017/03/01/10",
              "http://www.securityfocus.com/bid/96525",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=19519"
            ],
            "Description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10228",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: Memory leak in glob with GLOB_TILDE",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101517",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15671",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22325"
            ],
            "Description": "The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15671",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/109167",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22851",
              "https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp;utm_medium=RSS"
            ],
            "Description": "GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1010023",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 2.9,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries",
            "PkgName": "glibc",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-19126.html",
              "http://linux.oracle.com/errata/ELSA-2020-3861.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19126",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4FQ5LC6JOYSOYFPRUZ4S45KL6IP3RPPZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFJ5E7NWOL6ROE5QVICHKIOUGCPFJVUH/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25204",
              "https://sourceware.org/ml/libc-alpha/2019-11/msg00649.html",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.",
            "FixedVersion": "2.17-317.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19126",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: parse_reg_exp in posix/regcomp.c misparses alternatives leading to denial of service or trigger incorrect result",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5155",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238",
              "https://security.netapp.com/advisory/ntap-20190315-0002/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=11053",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=18986",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672",
              "https://support.f5.com/csp/article/K64119434",
              "https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp;utm_medium=RSS"
            ],
            "Description": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2009-5155",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: _IO_wstr_overflow integer overflow",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/02/22/15",
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/72740",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8983",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=17269",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bdf1ff052a8e23d637f2c838fa5642d78fcedc33",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html"
            ],
            "Description": "Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8983",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.6,
                "V3Score": 4.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: Stack-based buffer overflow in glob with GLOB_ALTDIRFUNC and crafted directory",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html",
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html",
              "http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html",
              "http://www.openwall.com/lists/oss-security/2016/03/07/16",
              "http://www.securityfocus.com/bid/84204",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1234",
              "https://security.gentoo.org/glsa/201702-11",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=19779",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5171f3079f2cc53e0548fc4967361f4d1ce9d7ea",
              "https://usn.ubuntu.com/usn/usn-3239-1"
            ],
            "Description": "Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1234",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html",
              "http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
              "http://www.securityfocus.com/bid/102073",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4429",
              "https://lists.debian.org/debian-lts-announce/2020/06/msg00027.html",
              "https://source.android.com/security/bulletin/2017-12-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20112",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bc779a1a5b3035133024b21e2f339fe4219fb11c",
              "https://usn.ubuntu.com/3759-1/",
              "https://usn.ubuntu.com/3759-2/",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://usn.ubuntu.com/usn/usn-3759-1",
              "https://usn.ubuntu.com/usn/usn-3759-2"
            ],
            "Description": "Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4429",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.8,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: memory leak in sunrpc when decoding malformed XDR",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00026.html",
              "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00049.html",
              "http://www.openwall.com/lists/oss-security/2017/05/05/2",
              "http://www.securityfocus.com/bid/98339",
              "https://bugzilla.suse.com/show_bug.cgi?id=1037559#c7",
              "https://seclists.org/oss-sec/2017/q2/228",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=21461",
              "https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00128.html",
              "https://sourceware.org/legacy-ml/libc-alpha/2017-05/msg00129.html",
              "https://sourceware.org/ml/libc-alpha/2017-05/msg00105.html"
            ],
            "Description": "** DISPUTED ** The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references]",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8804",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: stack guard protection bypass",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": ["https://sourceware.org/bugzilla/show_bug.cgi?id=22850"],
            "Description": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1010022",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/107160",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140",
              "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10278",
              "https://security.gentoo.org/glsa/202006-04",
              "https://security.netapp.com/advisory/ntap-20190315-0002/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24114",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9",
              "https://support.f5.com/csp/article/K54823184",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9169",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00033.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10029",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/23N76M3EDP2GIW4GOIQRYTKRE7PPBRB2/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZTFUD5VH2GU3YOXA2KBQSBIDZRDWNZ3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU5JJGENOK7K4X5RYAA5PL647C6HD22E/",
              "https://security.gentoo.org/glsa/202006-04",
              "https://security.netapp.com/advisory/ntap-20200327-0003/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25487",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=9333498794cde1d5cca518badf79533a24114b6f",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10029",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.7,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: use-after-free in glob() function when expanding ~user",
            "PkgName": "glibc-common",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1752",
              "https://security.netapp.com/advisory/ntap-20200511-0005/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25414",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ddc650e9b3dc916eab417ce9f79e67337b05035c",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1752",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 1,
                "V2Vector": "AV:L/AC:H/Au:S/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: posix_spawn_file_actions_addopen fails to copy the path argument",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00012.html",
              "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html",
              "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html",
              "http://seclists.org/fulldisclosure/2019/Jun/18",
              "http://seclists.org/fulldisclosure/2019/Sep/7",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2014:152",
              "http://www.openwall.com/lists/oss-security/2014/06/13/2",
              "http://www.securityfocus.com/bid/68006",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1109263",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/93784",
              "https://seclists.org/bugtraq/2019/Jun/14",
              "https://seclists.org/bugtraq/2019/Sep/7",
              "https://security.gentoo.org/glsa/201503-04",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=17048",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blobdiff;f=ChangeLog;h=3020b9ac232315df362521aeaf85f21cb9926db8;hp=d86e73963dd9fb5e21b1a28326630337226812aa;hb=89e435f3559c53084498e9baad22172b64429362;hpb=c3a2ebe1f7541cc35937621e08c28ff88afd0845",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=blobdiff;f=posix/spawn_faction_addopen.c;h=40800b8e6e81341501c0fb8a91009529e2048dec;hp=47f62425b696a4fdd511b2a057746322eb6518db;hb=89e435f3559c53084498e9baad22172b64429362;hpb=c3a2ebe1f7541cc35937621e08c28ff88afd0845",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=89e435f3559c53084498e9baad22172b64429362",
              "https://usn.ubuntu.com/usn/usn-2306-1"
            ],
            "Description": "The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-4043",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: multiple overflows in strxfrm()",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2015/09/08/2",
              "http://www.openwall.com/lists/oss-security/2015/02/13/3",
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/72602",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8982",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=16009",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=0f9e585480ed",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0f9e585480ed",
              "https://usn.ubuntu.com/usn/usn-3239-1"
            ],
            "Description": "Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8982",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: potential denial of service in internal_fnmatch()",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/02/26/5",
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/72789",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8984",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=18032",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4a28f4d55a6cc33474c0792fe93b5942d81bf185",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://www.sourceware.org/ml/libc-alpha/2015-08/msg00609.html"
            ],
            "Description": "The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8984",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: potential denial of service in pop_fail_stack()",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2017/02/14/9",
              "http://www.securityfocus.com/bid/76916",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8985",
              "https://security.gentoo.org/glsa/201908-06"
            ],
            "Description": "The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8985",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: iconv program can hang when invoked with the -c option",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2017/03/01/10",
              "http://www.securityfocus.com/bid/96525",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=19519"
            ],
            "Description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10228",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: Memory leak in glob with GLOB_TILDE",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101517",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15671",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22325"
            ],
            "Description": "The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15671",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: running ldd on malicious ELF leads to code execution because of wrong size computation",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/109167",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=22851",
              "https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp;utm_medium=RSS"
            ],
            "Description": "GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1010023",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 2.9,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries",
            "PkgName": "glibc-common",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-19126.html",
              "http://linux.oracle.com/errata/ELSA-2020-3861.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19126",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4FQ5LC6JOYSOYFPRUZ4S45KL6IP3RPPZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFJ5E7NWOL6ROE5QVICHKIOUGCPFJVUH/",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=25204",
              "https://sourceware.org/ml/libc-alpha/2019-11/msg00649.html",
              "https://usn.ubuntu.com/4416-1/",
              "https://usn.ubuntu.com/usn/usn-4416-1"
            ],
            "Description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.",
            "FixedVersion": "2.17-317.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19126",
            "InstalledVersion": "2.17-292.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glusterfs: fragment header infinite loop DoS",
            "PkgName": "glusterfs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0145.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00056.html",
              "http://review.gluster.org/#/c/8662/4",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:211",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1138145",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3619"
            ],
            "Description": "The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a \"00000000\" fragment header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3619",
            "InstalledVersion": "3.12.2-47.2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glusterfs: fragment header infinite loop DoS",
            "PkgName": "glusterfs-api",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0145.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00056.html",
              "http://review.gluster.org/#/c/8662/4",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:211",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1138145",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3619"
            ],
            "Description": "The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a \"00000000\" fragment header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3619",
            "InstalledVersion": "3.12.2-47.2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glusterfs: fragment header infinite loop DoS",
            "PkgName": "glusterfs-client-xlators",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0145.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00056.html",
              "http://review.gluster.org/#/c/8662/4",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:211",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1138145",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3619"
            ],
            "Description": "The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a \"00000000\" fragment header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3619",
            "InstalledVersion": "3.12.2-47.2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glusterfs: fragment header infinite loop DoS",
            "PkgName": "glusterfs-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0145.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2015-03/msg00056.html",
              "http://review.gluster.org/#/c/8662/4",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:211",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1138145",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3619"
            ],
            "Description": "The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a \"00000000\" fragment header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3619",
            "InstalledVersion": "3.12.2-47.2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "gnupg: infinite loop when decompressing data packets",
            "PkgName": "gnupg2",
            "Severity": "MEDIUM",
            "References": [
              "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=014b2103fcb12f261135e3954f26e9e07b39e342",
              "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=11fdfcf82bd8d2b5bc38292a29876e10770f4b0a",
              "http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000344.html",
              "http://lists.gnupg.org/pipermail/gnupg-announce/2014q2/000345.html",
              "http://lists.opensuse.org/opensuse-updates/2014-07/msg00010.html",
              "http://secunia.com/advisories/59213",
              "http://secunia.com/advisories/59351",
              "http://secunia.com/advisories/59534",
              "http://secunia.com/advisories/59578",
              "http://www.debian.org/security/2014/dsa-2967",
              "http://www.debian.org/security/2014/dsa-2968",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "http://www.ubuntu.com/usn/USN-2258-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4617",
              "https://usn.ubuntu.com/usn/usn-2258-1"
            ],
            "Description": "The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-4617",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS",
            "PkgName": "gnupg2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00039.html",
              "https://access.redhat.com/articles/4264021",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13050",
              "https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUK2YRO6QIH64WP2LRA5D4LACTXQPPU4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CP4ON34YEXEZDZOXXWV43KVGGO6WZLJ5/",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.html",
              "https://support.f5.com/csp/article/K08654551",
              "https://support.f5.com/csp/article/K08654551?utm_source=f5support&amp;utm_medium=RSS",
              "https://twitter.com/lambdafu/status/1147162583969009664"
            ],
            "Description": "Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13050",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.2,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libgcrypt: use ciphertext blinding for Elgamal decryption (new side-channel attack)",
            "PkgName": "gnupg2",
            "Severity": "LOW",
            "References": [
              "http://www.cs.tau.ac.il/~tromer/radioexp/",
              "http://www.debian.org/security/2015/dsa-3184",
              "http://www.debian.org/security/2015/dsa-3185",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html",
              "https://usn.ubuntu.com/usn/usn-2554-1",
              "https://usn.ubuntu.com/usn/usn-2555-1"
            ],
            "Description": "Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3591",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libgcrypt: last-level cache side-channel attack",
            "PkgName": "gnupg2",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2015/dsa-3184",
              "http://www.debian.org/security/2015/dsa-3185",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0837",
              "https://ieeexplore.ieee.org/document/7163050",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html",
              "https://usn.ubuntu.com/usn/usn-2554-1",
              "https://usn.ubuntu.com/usn/usn-2555-1"
            ],
            "Description": "The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a \"Last-Level Cache Side-Channel Attack.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0837",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "gnupg2: invalid memory read using a garbled keyring",
            "PkgName": "gnupg2",
            "Severity": "LOW",
            "References": [
              "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=f0f71a721ccd7ab9e40b8b6b028b59632c0cc648",
              "http://www.debian.org/security/2015/dsa-3184",
              "http://www.openwall.com/lists/oss-security/2015/02/13/14",
              "http://www.openwall.com/lists/oss-security/2015/02/14/6",
              "http://www.securitytracker.com/id/1031876",
              "https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1606",
              "https://usn.ubuntu.com/usn/usn-2554-1"
            ],
            "Description": "The keyring DB in GnuPG before 2.1.2 does not properly handle invalid packets, which allows remote attackers to cause a denial of service (invalid read and use-after-free) via a crafted keyring file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1606",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "gnupg2: memcpy with overlapping ranges (keybox_search.c)",
            "PkgName": "gnupg2",
            "Severity": "LOW",
            "References": [
              "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2183683bd633818dd031b090b5530951de76f392",
              "http://www.openwall.com/lists/oss-security/2015/02/13/14",
              "http://www.openwall.com/lists/oss-security/2015/02/14/6",
              "http://www.securityfocus.com/bid/72610",
              "http://www.ubuntu.com/usn/usn-2554-1/",
              "https://blog.fuzzing-project.org/5-Multiple-issues-in-GnuPG-found-through-keyring-fuzzing-TFPA-0012015.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1607",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000362.html",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html",
              "https://usn.ubuntu.com/usn/usn-2554-1"
            ],
            "Description": "kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and \"memcpy with overlapping ranges.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1607",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 2.2,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "GnuPG: Unenforced configuration allows for apparently valid certifications actually signed by signing subkeys",
            "PkgName": "gnupg2",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9234",
              "https://dev.gnupg.org/T3844",
              "https://usn.ubuntu.com/3675-1/",
              "https://usn.ubuntu.com/usn/usn-3675-1"
            ],
            "Description": "GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-9234",
            "InstalledVersion": "2.0.22-5.el7_5"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "gpgme: heap-based buffer overflow in gpgsm status handler",
            "PkgName": "gpgme",
            "Severity": "LOW",
            "References": [
              "http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=commit;h=2cbd76f7911fc215845e89b50d6af5ff4a83dd77",
              "http://seclists.org/oss-sec/2014/q3/266",
              "http://www.debian.org/security/2014/dsa-3005",
              "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
              "http://www.osvdb.org/109699",
              "http://www.securityfocus.com/bid/68990",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1113267",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3564",
              "https://usn.ubuntu.com/usn/usn-2307-1"
            ],
            "Description": "Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to \"different line lengths in a specific order.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3564",
            "InstalledVersion": "1.3.2-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "iproute: use-after-free in get_netnsid_from_name in ip/ipnetns.c",
            "PkgName": "iproute",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.suse.com/show_bug.cgi?id=1171452",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20795",
              "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/commit/?id=9bf2c538a0eb10d66e2365a655bf6c52f5ba3d10",
              "https://security.gentoo.org/glsa/202008-06",
              "https://usn.ubuntu.com/4357-1/",
              "https://usn.ubuntu.com/usn/usn-4357-1"
            ],
            "Description": "iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20795",
            "InstalledVersion": "4.11.0-25.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "jansson: stack exhaustion parsing a JSON file",
            "PkgName": "jansson",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2015/dsa-3577",
              "http://www.openwall.com/lists/oss-security/2016/05/01/5",
              "http://www.openwall.com/lists/oss-security/2016/05/02/1",
              "http://www.openwall.com/lists/oss-security/2016/05/03/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4425",
              "https://github.com/akheron/jansson/issues/282",
              "https://github.com/akheron/jansson/pull/284",
              "https://github.com/akheron/jansson/pull/284/commits/64ce0ad3731ebd77e02897b07920eadd0e2cc318"
            ],
            "Description": "Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4425",
            "InstalledVersion": "2.10-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "json-c: integer overflow and out-of-bounds write via a large JSON file",
            "PkgName": "json-c",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12762",
              "https://github.com/json-c/json-c/pull/592",
              "https://github.com/rsyslog/libfastjson/issues/161",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00032.html",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00034.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00031.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBR36IXYBHITAZFB5PFBJTED22WO5ONB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W226TSCJBEOXDUFVKNWNH7ETG7AR6MCS/",
              "https://security.gentoo.org/glsa/202006-13",
              "https://usn.ubuntu.com/4360-1/",
              "https://usn.ubuntu.com/4360-4/",
              "https://usn.ubuntu.com/usn/usn-4360-1",
              "https://usn.ubuntu.com/usn/usn-4360-4",
              "https://www.debian.org/security/2020/dsa-4741"
            ],
            "Description": "json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12762",
            "InstalledVersion": "0.11-4.el7_0"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:N/AC:H/Au:S/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:N/AC:H/Au:S/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "krb5: current keys returned when randomizing the keys for a service principal",
            "PkgName": "krb5-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0477.html",
              "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8018",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140132.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html",
              "http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html",
              "http://security.gentoo.org/glsa/glsa-201412-53.xml",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2014:224",
              "http://www.securityfocus.com/bid/70380",
              "http://www.securitytracker.com/id/1031003",
              "http://www.ubuntu.com/usn/USN-2498-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1145425",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5351",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/97028",
              "https://github.com/krb5/krb5/commit/af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca",
              "https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html",
              "https://usn.ubuntu.com/usn/usn-2498-1"
            ],
            "Description": "The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5351",
            "InstalledVersion": "1.15.1-37.el7_7.2"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "krb5: SPNEGO context aliasing bugs",
            "PkgName": "krb5-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8244",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00007.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00022.html",
              "http://www.debian.org/security/2015/dsa-3395",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.securityfocus.com/bid/90687",
              "http://www.securitytracker.com/id/1034084",
              "http://www.ubuntu.com/usn/USN-2810-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2695",
              "https://github.com/krb5/krb5/commit/b51b33f2bc5d1497ddf5bd107f791c101695000d",
              "https://security.gentoo.org/glsa/201611-14",
              "https://usn.ubuntu.com/usn/usn-2810-1"
            ],
            "Description": "lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2695",
            "InstalledVersion": "1.15.1-37.el7_7.2"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "krb5: IAKERB context aliasing flaw",
            "PkgName": "krb5-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8244",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00022.html",
              "http://www.debian.org/security/2015/dsa-3395",
              "http://www.securityfocus.com/bid/90675",
              "http://www.securitytracker.com/id/1034084",
              "http://www.ubuntu.com/usn/USN-2810-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2696",
              "https://github.com/krb5/krb5/commit/e04f0283516e80d2f93366e0d479d13c9b5c8c2a",
              "https://security.gentoo.org/glsa/201611-14",
              "https://usn.ubuntu.com/usn/usn-2810-1"
            ],
            "Description": "lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2696",
            "InstalledVersion": "1.15.1-37.el7_7.2"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:C"
              },
              "redhat": {
                "V2Score": 4,
                "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "krb5: build_principal() memory flaw",
            "PkgName": "krb5-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8252",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00022.html",
              "http://www.debian.org/security/2015/dsa-3395",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.securityfocus.com/bid/77581",
              "http://www.securitytracker.com/id/1034084",
              "http://www.ubuntu.com/usn/USN-2810-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2697",
              "https://github.com/krb5/krb5/commit/f0c094a1b745d91ef2f9a4eae2149aac026a5789",
              "https://security.gentoo.org/glsa/201611-14",
              "https://usn.ubuntu.com/usn/usn-2810-1"
            ],
            "Description": "The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\\0' character in a long realm field within a TGS request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2697",
            "InstalledVersion": "1.15.1-37.el7_7.2"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "krb5: Buffer overflow in get_matching_data()",
            "PkgName": "krb5-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/101594",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1504045",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15088",
              "https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4",
              "https://github.com/krb5/krb5/pull/707"
            ],
            "Description": "plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15088",
            "InstalledVersion": "1.15.1-37.el7_7.2"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "krb5: Automatic sec context deletion could lead to double-free",
            "PkgName": "krb5-libs",
            "Severity": "LOW",
            "References": [
              "http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1488873",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11462",
              "https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/"
            ],
            "Description": "Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11462",
            "InstalledVersion": "1.15.1-37.el7_7.2"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: command injection flaw in blkid",
            "PkgName": "libblkid",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html",
              "http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html",
              "http://www.openwall.com/lists/oss-security/2014/11/26/21",
              "http://www.securityfocus.com/bid/71327",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1168485",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9114",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/98993",
              "https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc",
              "https://security.gentoo.org/glsa/201612-14"
            ],
            "Description": "Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9114",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 8.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: runuser tty hijack via TIOCSTI ioctl",
            "PkgName": "libblkid",
            "Severity": "MEDIUM",
            "References": [
              "http://marc.info/?l=util-linux-ng&m=145694736107128&w=2",
              "http://www.openwall.com/lists/oss-security/2016/02/27/1",
              "http://www.openwall.com/lists/oss-security/2016/02/27/2",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2779"
            ],
            "Description": "runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2779",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "colcrt: global-buffer-overflow",
            "PkgName": "libblkid",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00035.html",
              "http://www.spinics.net/lists/util-linux-ng/msg11873.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1259322",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5218",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec",
              "https://www.kernel.org/pub/linux/utils/util-linux/v2.27/v2.27-ReleaseNotes"
            ],
            "Description": "Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5218",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: ext2fs_open2() missing first_meta_bg boundary check leading to heap buffer overflow (oCERT-015-002)",
            "PkgName": "libcom_err",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0061.html",
              "http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:045",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.ocert.org/advisories/ocert-2015-002.html",
              "http://www.securityfocus.com/archive/1/534633/100/0/threaded",
              "http://www.securityfocus.com/bid/72520",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1187032",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/100740",
              "https://security.gentoo.org/glsa/201701-06",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0247",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write",
            "PkgName": "libcom_err",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5094.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://seclists.org/bugtraq/2019/Sep/58",
              "https://security.gentoo.org/glsa/202003-05",
              "https://security.netapp.com/advisory/ntap-20200115-0002/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
              "https://usn.ubuntu.com/4142-1/",
              "https://usn.ubuntu.com/4142-2/",
              "https://usn.ubuntu.com/usn/usn-4142-1",
              "https://usn.ubuntu.com/usn/usn-4142-2",
              "https://www.debian.org/security/2019/dsa-4535"
            ],
            "Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5094",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c",
            "PkgName": "libcom_err",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5188.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
              "https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973",
              "https://usn.ubuntu.com/4249-1/",
              "https://usn.ubuntu.com/usn/usn-4249-1"
            ],
            "Description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5188",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: potential buffer overflow in closefs() (incomplete CVE-2015-0247 fix)",
            "PkgName": "libcom_err",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0088.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00006.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:068",
              "http://www.securityfocus.com/bid/72709",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1572",
              "https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73",
              "https://security.gentoo.org/glsa/201507-22",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1572",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: sensitive HTTP server headers also sent to proxies",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://curl.haxx.se/docs/adv_20150429.html",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743",
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html",
              "http://www.debian.org/security/2015/dsa-3240",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html",
              "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html",
              "http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html",
              "http://www.securityfocus.com/bid/74408",
              "http://www.securitytracker.com/id/1032233",
              "http://www.ubuntu.com/usn/USN-2591-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3153",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10131",
              "https://support.apple.com/kb/HT205031",
              "https://usn.ubuntu.com/usn/usn-2591-1"
            ],
            "Description": "The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3153",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Cookie injection for other servers",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8615.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94096",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8615",
              "https://curl.haxx.se/CVE-2016-8615.patch",
              "https://curl.haxx.se/docs/adv_20161102A.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8615",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8615",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Out-of-bounds write via unchecked multiplication",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8617.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94097",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8617",
              "https://curl.haxx.se/CVE-2016-8617.patch",
              "https://curl.haxx.se/docs/adv_20161102C.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8617",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8617",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Double-free in curl_maprintf",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8618.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94098",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618",
              "https://curl.haxx.se/docs/adv_20161102D.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8618",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8618",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Double-free in krb5 code",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8619.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94100",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619",
              "https://curl.haxx.se/CVE-2016-8619.patch",
              "https://curl.haxx.se/docs/adv_20161102E.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8619",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8619",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Invalid URL parsing with '#'",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8624.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94103",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624",
              "https://curl.haxx.se/docs/adv_20161102J.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8624",
              "https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5@%3Ccommits.pulsar.apache.org%3E",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8624",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: IDNA 2003 makes curl use wrong host",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8625.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.securityfocus.com/bid/94107",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625",
              "https://curl.haxx.se/CVE-2016-8625.patch",
              "https://curl.haxx.se/docs/adv_20161102K.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8625",
              "https://security.gentoo.org/glsa/201701-47",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8625",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: FTP PWD response parser out of bounds read",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3992",
              "http://www.securityfocus.com/bid/101115",
              "http://www.securitytracker.com/id/1039509",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/673d0cd8.patch",
              "https://curl.haxx.se/docs/adv_20171004.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254",
              "https://security.gentoo.org/glsa/201712-04",
              "https://support.apple.com/HT208331",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000254",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: FTP wildcard out of bounds read",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://security.cucumberlinux.com/security/details.php?id=162",
              "http://www.securityfocus.com/bid/102057",
              "http://www.securitytracker.com/id/1039897",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/docs/adv_2017-ae72.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8817",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html",
              "https://security.gentoo.org/glsa/201712-04",
              "https://usn.ubuntu.com/usn/usn-3498-1",
              "https://usn.ubuntu.com/usn/usn-3498-2",
              "https://www.debian.org/security/2017/dsa-4051"
            ],
            "Description": "The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8817",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "wget: Information exposure in set_file_metadata function in xattr.c",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/wget.git/tree/NEWS",
              "http://linux.oracle.com/cve/CVE-2018-20483.html",
              "http://linux.oracle.com/errata/ELSA-2019-3701.html",
              "http://www.securityfocus.com/bid/106358",
              "https://access.redhat.com/errata/RHSA-2019:3701",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20483",
              "https://security.gentoo.org/glsa/201903-08",
              "https://security.netapp.com/advisory/ntap-20190321-0002/",
              "https://twitter.com/marcan42/status/1077676739877232640",
              "https://usn.ubuntu.com/3943-1/",
              "https://usn.ubuntu.com/usn/usn-3943-1"
            ],
            "Description": "set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20483",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.3,
                "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: heap buffer overflow in function tftp_receive_packet()",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5482.html",
              "http://linux.oracle.com/errata/ELSA-2020-5562.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
              "https://curl.haxx.se/docs/CVE-2019-5482.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
              "https://seclists.org/bugtraq/2020/Feb/36",
              "https://security.gentoo.org/glsa/202003-29",
              "https://security.netapp.com/advisory/ntap-20191004-0003/",
              "https://security.netapp.com/advisory/ntap-20200416-0003/",
              "https://usn.ubuntu.com/usn/usn-4129-1",
              "https://usn.ubuntu.com/usn/usn-4129-2",
              "https://www.debian.org/security/2020/dsa-4633",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html"
            ],
            "Description": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
            "FixedVersion": "7.29.0-59.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5482",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Incorrect argument check can allow remote servers to overwrite local files",
            "PkgName": "libcurl",
            "Severity": "MEDIUM",
            "References": [
              "https://curl.haxx.se/docs/CVE-2020-8177.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177",
              "https://usn.ubuntu.com/usn/usn-4402-1"
            ],
            "Description": "A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is to file integrity.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8177",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V2Score": 4,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: NTLM credentials not-checked for proxy connection re-use",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://curl.haxx.se/docs/adv_20160127A.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.html",
              "http://lists.opensuse.org/opensuse-updates/2016-02/msg00031.html",
              "http://lists.opensuse.org/opensuse-updates/2016-02/msg00044.html",
              "http://lists.opensuse.org/opensuse-updates/2016-02/msg00047.html",
              "http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html",
              "http://www.debian.org/security/2016/dsa-3455",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/82307",
              "http://www.securitytracker.com/id/1034882",
              "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.519965",
              "http://www.ubuntu.com/usn/USN-2882-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0755",
              "https://security.gentoo.org/glsa/201701-47",
              "https://support.apple.com/HT207170",
              "https://usn.ubuntu.com/usn/usn-2882-1"
            ],
            "Description": "The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-0755",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Case insensitive password comparison",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8616.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94094",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8616",
              "https://curl.haxx.se/CVE-2016-8616.patch",
              "https://curl.haxx.se/docs/adv_20161102B.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8616",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8616",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: curl_getdate out-of-bounds read",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8621.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94101",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8621",
              "https://curl.haxx.se/CVE-2016-8621.patch",
              "https://curl.haxx.se/docs/adv_20161102G.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8621",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8621",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: URL unescape heap overflow via integer truncation",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8622.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94105",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622",
              "https://curl.haxx.se/docs/adv_20161102H.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8622",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8622",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Use-after-free via shared cookies",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-8623.html",
              "http://linux.oracle.com/errata/ELSA-2019-4652.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/94106",
              "http://www.securitytracker.com/id/1037192",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8623",
              "https://curl.haxx.se/CVE-2016-8623.patch",
              "https://curl.haxx.se/docs/adv_20161102I.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8623",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3123-1",
              "https://www.tenable.com/security/tns-2016-21"
            ],
            "Description": "A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-8623",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: printf floating point buffer overflow",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "http://www.securityfocus.com/bid/95019",
              "http://www.securitytracker.com/id/1037515",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9586",
              "https://curl.haxx.se/docs/adv_20161221A.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9586",
              "https://github.com/curl/curl/commit/curl-7_51_0-162-g3ab3c16",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html",
              "https://security.gentoo.org/glsa/201701-47",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9586",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: TFTP sends more than buffer size",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2017/dsa-3992",
              "http://www.securityfocus.com/bid/100286",
              "http://www.securitytracker.com/id/1039118",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/docs/adv_20170809B.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100",
              "https://security.gentoo.org/glsa/201709-14",
              "https://support.apple.com/HT208221",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000100",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 2.4,
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: --write-out out of bounds read",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
              "https://access.redhat.com/errata/RHSA-2018:3558",
              "https://curl.haxx.se/docs/adv_20170403.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7407",
              "https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13",
              "https://security.gentoo.org/glsa/201709-14",
              "https://usn.ubuntu.com/usn/usn-3441-1",
              "https://usn.ubuntu.com/usn/usn-3441-2"
            ],
            "Description": "The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7407",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: TFTP receive heap buffer overflow in tftp_receive_packet() function",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5436.html",
              "http://linux.oracle.com/errata/ELSA-2020-1792.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html",
              "http://www.openwall.com/lists/oss-security/2019/09/11/6",
              "https://curl.haxx.se/docs/CVE-2019-5436.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/",
              "https://seclists.org/bugtraq/2020/Feb/36",
              "https://security.gentoo.org/glsa/202003-29",
              "https://security.netapp.com/advisory/ntap-20190606-0004/",
              "https://support.f5.com/csp/article/K55133295",
              "https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/usn/usn-3993-1",
              "https://usn.ubuntu.com/usn/usn-3993-2",
              "https://www.debian.org/security/2020/dsa-4633",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            ],
            "Description": "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.",
            "FixedVersion": "7.29.0-57.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5436",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 3.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "curl: Expired pointer dereference via multi API with `CURLOPT_CONNECT_ONLY` option set",
            "PkgName": "libcurl",
            "Severity": "LOW",
            "References": [
              "https://curl.haxx.se/docs/CVE-2020-8231.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8231",
              "https://usn.ubuntu.com/usn/usn-4466-1",
              "https://usn.ubuntu.com/usn/usn-4466-2"
            ],
            "Description": "A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple requests with libcurl's multi API, and sets the `CURLOPT_CONNECT_ONLY` option, might experience libcurl using the wrong connection. The highest threat from this vulnerability is to data confidentiality.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8231",
            "InstalledVersion": "7.29.0-54.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libdb: Reads DB_CONFIG from the current working directory",
            "PkgName": "libdb",
            "Severity": "MEDIUM",
            "References": [
              "http://seclists.org/oss-sec/2017/q3/285",
              "http://www.openwall.com/lists/oss-security/2017/08/12/1",
              "http://www.postfix.org/announcements/postfix-3.2.2.html",
              "https://access.redhat.com/errata/RHSA-2019:0366",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10140",
              "https://usn.ubuntu.com/usn/usn-3489-1",
              "https://usn.ubuntu.com/usn/usn-3489-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10140",
            "InstalledVersion": "5.3.21-25.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libdb: data store execution leads to partial DoS",
            "PkgName": "libdb",
            "Severity": "LOW",
            "References": ["http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],
            "Description": "Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-2708",
            "InstalledVersion": "5.3.21-25.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libdb: Reads DB_CONFIG from the current working directory",
            "PkgName": "libdb-utils",
            "Severity": "MEDIUM",
            "References": [
              "http://seclists.org/oss-sec/2017/q3/285",
              "http://www.openwall.com/lists/oss-security/2017/08/12/1",
              "http://www.postfix.org/announcements/postfix-3.2.2.html",
              "https://access.redhat.com/errata/RHSA-2019:0366",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10140",
              "https://usn.ubuntu.com/usn/usn-3489-1",
              "https://usn.ubuntu.com/usn/usn-3489-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10140",
            "InstalledVersion": "5.3.21-25.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libdb: data store execution leads to partial DoS",
            "PkgName": "libdb-utils",
            "Severity": "LOW",
            "References": ["http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],
            "Description": "Vulnerability in the Data Store component of Oracle Berkeley DB. Supported versions that are affected are Prior to 6.138, prior to 6.2.38 and prior to 18.1.32. Easily exploitable vulnerability allows low privileged attacker having Local Logon privilege with logon to the infrastructure where Data Store executes to compromise Data Store. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Data Store. CVSS 3.0 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-2708",
            "InstalledVersion": "5.3.21-25.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libevent: potential heap overflow in buffer/bufferevent APIs",
            "PkgName": "libevent",
            "Severity": "MEDIUM",
            "References": [
              "http://archives.seul.org/libevent/users/Jan-2015/msg00010.html",
              "http://archives.seul.org/libevent/users/Jan-2015/msg00011.html",
              "http://archives.seul.org/libevent/users/Jan-2015/msg00012.html",
              "http://archives.seul.org/libevent/users/Jan-2015/msg00013.html",
              "http://www.debian.org/security/2015/dsa-3119",
              "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.366317",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6272",
              "https://puppet.com/security/cve/CVE-2014-6272",
              "https://usn.ubuntu.com/usn/usn-2477-1"
            ],
            "Description": "Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via \"insanely large inputs\" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-6272",
            "InstalledVersion": "2.0.21-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libevent: multiple integer overflows in the evbuffer APIs",
            "PkgName": "libevent",
            "Severity": "MEDIUM",
            "References": [
              "http://archives.seul.org/libevent/users/Jan-2015/msg00010.html",
              "http://www.debian.org/security/2015/dsa-3119",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6525",
              "https://usn.ubuntu.com/usn/usn-2477-1/"
            ],
            "Description": "Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via \"insanely large inputs\" to the (1) evbuffer_add, (2) evbuffer_prepend, (3) evbuffer_expand, (4) exbuffer_reserve_space, or (5) evbuffer_read function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier was SPLIT from CVE-2014-6272 per ADT3 due to different affected versions.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-6525",
            "InstalledVersion": "2.0.21-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libevent: Stack-buffer overflow in the name_parse() function",
            "PkgName": "libevent",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-10195.html",
              "http://linux.oracle.com/errata/ELSA-2017-1201.html",
              "http://www.debian.org/security/2017/dsa-3789",
              "http://www.openwall.com/lists/oss-security/2017/01/31/17",
              "http://www.openwall.com/lists/oss-security/2017/02/02/7",
              "http://www.securityfocus.com/bid/96014",
              "http://www.securitytracker.com/id/1038320",
              "https://access.redhat.com/errata/RHSA-2017:1104",
              "https://access.redhat.com/errata/RHSA-2017:1106",
              "https://access.redhat.com/errata/RHSA-2017:1201",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10195",
              "https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog",
              "https://github.com/libevent/libevent/commit/96f64a022014a208105ead6c8a7066018449d86d",
              "https://github.com/libevent/libevent/issues/317",
              "https://security.gentoo.org/glsa/201705-01",
              "https://usn.ubuntu.com/usn/usn-3228-1",
              "https://usn.ubuntu.com/usn/usn-3278-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/"
            ],
            "Description": "The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10195",
            "InstalledVersion": "2.0.21-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libevent: Stack-buffer overflow in evutil_parse_sockaddr_port()",
            "PkgName": "libevent",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-10196.html",
              "http://linux.oracle.com/errata/ELSA-2017-1201.html",
              "http://www.debian.org/security/2017/dsa-3789",
              "http://www.openwall.com/lists/oss-security/2017/01/31/17",
              "http://www.openwall.com/lists/oss-security/2017/02/02/7",
              "http://www.securityfocus.com/bid/96014",
              "http://www.securitytracker.com/id/1038320",
              "https://access.redhat.com/errata/RHSA-2017:1104",
              "https://access.redhat.com/errata/RHSA-2017:1106",
              "https://access.redhat.com/errata/RHSA-2017:1201",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1343453",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10196",
              "https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog",
              "https://github.com/libevent/libevent/commit/329acc18a0768c21ba22522f01a5c7f46cacc4d5",
              "https://github.com/libevent/libevent/issues/318",
              "https://security.gentoo.org/glsa/201705-01",
              "https://usn.ubuntu.com/usn/usn-3228-1",
              "https://usn.ubuntu.com/usn/usn-3278-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/",
              "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            ],
            "Description": "Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10196",
            "InstalledVersion": "2.0.21-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libevent: Out-of-bounds read in search_make_new()",
            "PkgName": "libevent",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-10197.html",
              "http://linux.oracle.com/errata/ELSA-2017-1201.html",
              "http://www.debian.org/security/2017/dsa-3789",
              "http://www.openwall.com/lists/oss-security/2017/01/31/17",
              "http://www.openwall.com/lists/oss-security/2017/02/02/7",
              "http://www.securityfocus.com/bid/96014",
              "http://www.securitytracker.com/id/1038320",
              "https://access.redhat.com/errata/RHSA-2017:1104",
              "https://access.redhat.com/errata/RHSA-2017:1106",
              "https://access.redhat.com/errata/RHSA-2017:1201",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10197",
              "https://github.com/libevent/libevent/blob/release-2.1.6-beta/ChangeLog",
              "https://github.com/libevent/libevent/commit/ec65c42052d95d2c23d1d837136d1cf1d9ecef9e",
              "https://github.com/libevent/libevent/issues/332",
              "https://security.gentoo.org/glsa/201705-01",
              "https://usn.ubuntu.com/usn/usn-3228-1",
              "https://usn.ubuntu.com/usn/usn-3278-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/"
            ],
            "Description": "The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-10197",
            "InstalledVersion": "2.0.21-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: integer overflow flaws in libgfortran",
            "PkgName": "libgcc",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2014/07/23/7",
              "http://www.openwall.com/lists/oss-security/2014/07/24/1",
              "http://www.openwall.com/lists/oss-security/2014/07/31/6",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1122812",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5044",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/94849",
              "https://gcc.gnu.org/viewcvs/gcc/trunk/libgfortran/ChangeLog?limit_changes=0&view=markup&pathrev=211721",
              "https://gcc.gnu.org/viewcvs/gcc?limit_changes=0&view=revision&revision=211721"
            ],
            "Description": "Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5044",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Integer overflow in demangle_template() function",
            "PkgName": "libgcc",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/106454",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24039"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for \"Create an array for saving the template argument values\") that can trigger a heap-based buffer overflow, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20673",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling",
            "PkgName": "libgcc",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16276.html",
              "http://linux.oracle.com/errata/ELSA-2020-0329.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html",
              "https://access.redhat.com/errata/RHSA-2020:0101",
              "https://access.redhat.com/errata/RHSA-2020:0329",
              "https://access.redhat.com/errata/RHSA-2020:0652",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276",
              "https://github.com/golang/go/issues/34540",
              "https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/",
              "https://security.netapp.com/advisory/ntap-20191122-0004/"
            ],
            "Description": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs",
            "PkgName": "libgcc",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-16845.html",
              "http://linux.oracle.com/errata/ELSA-2020-5828.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845",
              "https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo",
              "https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q",
              "https://groups.google.com/g/golang-announce/c/NyPIaucMgXo",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/",
              "https://security.netapp.com/advisory/ntap-20200924-0002/"
            ],
            "Description": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-16845",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS",
            "PkgName": "libgcc",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html",
              "http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html",
              "http://seclists.org/fulldisclosure/2020/Sep/5",
              "https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/",
              "https://security.netapp.com/advisory/ntap-20200924-0003/",
              "https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting"
            ],
            "Description": "Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-24553",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Predictable randomness from std::random_device",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html",
              "http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html",
              "http://www.securitytracker.com/id/1034375",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1262846",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5276",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142",
              "https://gcc.gnu.org/ml/gcc-patches/2015-09/msg01050.html"
            ],
            "Description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Exploitable buffer overflow",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2226",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1",
              "https://www.exploit-db.com/exploits/42386/"
            ],
            "Description": "Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2226",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array btypevec",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4487",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4487",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array ktypevec",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4488",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"ktypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4488",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to integer overflow",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4489",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70492",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the \"demangling of virtual tables.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4489",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Write access violation",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90019",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4490",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70498",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4490",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Stack overflow due to infinite recursion in d_print_comp",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90016",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4491",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70909",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00105.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having \"itself as ancestor more than once.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4491",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 4.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4492",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4492",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4493",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4493",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Memory leak in demangle_template function resulting in a denial of service",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20657.html",
              "http://linux.oracle.com/errata/ELSA-2019-3352.html",
              "http://www.securityfocus.com/bid/106444",
              "https://access.redhat.com/errata/RHSA-2019:3352",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20657",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539",
              "https://support.f5.com/csp/article/K62602089"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20657",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: integer overflow in simple-object-elf.c leads to a heap-based buffer overflow",
            "PkgName": "libgcc",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html",
              "http://www.securityfocus.com/bid/109354",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14250",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924",
              "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20190822-0002/",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14250",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libgcrypt: ELGAMAL side-channel attack",
            "PkgName": "libgcrypt",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.gnupg.org/pipermail/gnupg-announce/2014q3/000352.html",
              "http://openwall.com/lists/oss-security/2014/08/16/2",
              "http://www.cs.tau.ac.il/~tromer/handsoff/",
              "http://www.debian.org/security/2014/dsa-3024",
              "http://www.debian.org/security/2014/dsa-3073",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5270",
              "https://usn.ubuntu.com/usn/usn-2339-1",
              "https://usn.ubuntu.com/usn/usn-2339-2"
            ],
            "Description": "Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5270",
            "InstalledVersion": "1.5.3-14.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libgcrypt: Use of left-to-right sliding window method allows full RSA key recovery",
            "PkgName": "libgcrypt",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/99338",
              "http://www.securitytracker.com/id/1038915",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7526",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7526",
              "https://eprint.iacr.org/2017/627",
              "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=78130828e9a140a9de4dafadbc844dbb64cb709a",
              "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=8725c99ffa41778f382ca97233183bcd687bb0ce",
              "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=e6a3dc9900433bbc8ad362a595a3837318c28fa9",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000408.html",
              "https://usn.ubuntu.com/3733-1/",
              "https://usn.ubuntu.com/3733-2/",
              "https://usn.ubuntu.com/usn/usn-3347-1",
              "https://usn.ubuntu.com/usn/usn-3347-2",
              "https://usn.ubuntu.com/usn/usn-3733-1",
              "https://usn.ubuntu.com/usn/usn-3733-2",
              "https://www.debian.org/security/2017/dsa-3901",
              "https://www.debian.org/security/2017/dsa-3960"
            ],
            "Description": "libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7526",
            "InstalledVersion": "1.5.3-14.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel attack",
            "PkgName": "libgcrypt",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12904",
              "https://dev.gnupg.org/T4541",
              "https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020",
              "https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762",
              "https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12904.html"
            ],
            "Description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-12904",
            "InstalledVersion": "1.5.3-14.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.2,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libgcrypt: use ciphertext blinding for Elgamal decryption (new side-channel attack)",
            "PkgName": "libgcrypt",
            "Severity": "LOW",
            "References": [
              "http://www.cs.tau.ac.il/~tromer/radioexp/",
              "http://www.debian.org/security/2015/dsa-3184",
              "http://www.debian.org/security/2015/dsa-3185",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3591",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html",
              "https://usn.ubuntu.com/usn/usn-2554-1",
              "https://usn.ubuntu.com/usn/usn-2555-1"
            ],
            "Description": "Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-3591",
            "InstalledVersion": "1.5.3-14.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libgcrypt: last-level cache side-channel attack",
            "PkgName": "libgcrypt",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2015/dsa-3184",
              "http://www.debian.org/security/2015/dsa-3185",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0837",
              "https://ieeexplore.ieee.org/document/7163050",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000363.html",
              "https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000364.html",
              "https://usn.ubuntu.com/usn/usn-2554-1",
              "https://usn.ubuntu.com/usn/usn-2555-1"
            ],
            "Description": "The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a \"Last-Level Cache Side-Channel Attack.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0837",
            "InstalledVersion": "1.5.3-14.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: integer overflow flaws in libgfortran",
            "PkgName": "libgfortran",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2014/07/23/7",
              "http://www.openwall.com/lists/oss-security/2014/07/24/1",
              "http://www.openwall.com/lists/oss-security/2014/07/31/6",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1122812",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5044",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/94849",
              "https://gcc.gnu.org/viewcvs/gcc/trunk/libgfortran/ChangeLog?limit_changes=0&view=markup&pathrev=211721",
              "https://gcc.gnu.org/viewcvs/gcc?limit_changes=0&view=revision&revision=211721"
            ],
            "Description": "Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5044",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Integer overflow in demangle_template() function",
            "PkgName": "libgfortran",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/106454",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24039"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for \"Create an array for saving the template argument values\") that can trigger a heap-based buffer overflow, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20673",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling",
            "PkgName": "libgfortran",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16276.html",
              "http://linux.oracle.com/errata/ELSA-2020-0329.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html",
              "https://access.redhat.com/errata/RHSA-2020:0101",
              "https://access.redhat.com/errata/RHSA-2020:0329",
              "https://access.redhat.com/errata/RHSA-2020:0652",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276",
              "https://github.com/golang/go/issues/34540",
              "https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/",
              "https://security.netapp.com/advisory/ntap-20191122-0004/"
            ],
            "Description": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs",
            "PkgName": "libgfortran",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-16845.html",
              "http://linux.oracle.com/errata/ELSA-2020-5828.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845",
              "https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo",
              "https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q",
              "https://groups.google.com/g/golang-announce/c/NyPIaucMgXo",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/",
              "https://security.netapp.com/advisory/ntap-20200924-0002/"
            ],
            "Description": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-16845",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS",
            "PkgName": "libgfortran",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html",
              "http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html",
              "http://seclists.org/fulldisclosure/2020/Sep/5",
              "https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/",
              "https://security.netapp.com/advisory/ntap-20200924-0003/",
              "https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting"
            ],
            "Description": "Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-24553",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Predictable randomness from std::random_device",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html",
              "http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html",
              "http://www.securitytracker.com/id/1034375",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1262846",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5276",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142",
              "https://gcc.gnu.org/ml/gcc-patches/2015-09/msg01050.html"
            ],
            "Description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Exploitable buffer overflow",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2226",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1",
              "https://www.exploit-db.com/exploits/42386/"
            ],
            "Description": "Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2226",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array btypevec",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4487",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4487",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array ktypevec",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4488",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"ktypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4488",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to integer overflow",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4489",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70492",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the \"demangling of virtual tables.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4489",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Write access violation",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90019",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4490",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70498",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4490",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Stack overflow due to infinite recursion in d_print_comp",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90016",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4491",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70909",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00105.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having \"itself as ancestor more than once.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4491",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 4.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4492",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4492",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4493",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4493",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Memory leak in demangle_template function resulting in a denial of service",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20657.html",
              "http://linux.oracle.com/errata/ELSA-2019-3352.html",
              "http://www.securityfocus.com/bid/106444",
              "https://access.redhat.com/errata/RHSA-2019:3352",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20657",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539",
              "https://support.f5.com/csp/article/K62602089"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20657",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: integer overflow in simple-object-elf.c leads to a heap-based buffer overflow",
            "PkgName": "libgfortran",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html",
              "http://www.securityfocus.com/bid/109354",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14250",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924",
              "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20190822-0002/",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14250",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libidn: out-of-bounds read with stringprep on invalid UTF-8",
            "PkgName": "libidn",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=2e97c279",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162537.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162549.html",
              "http://lists.opensuse.org/opensuse-updates/2015-07/msg00042.html",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html",
              "http://www.debian.org/security/2016/dsa-3578",
              "http://www.openwall.com/lists/oss-security/2015/02/23/25",
              "http://www.securityfocus.com/bid/72736",
              "http://www.ubuntu.com/usn/USN-3068-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2059",
              "https://github.com/jabberd2/jabberd2/issues/85",
              "https://lists.gnu.org/archive/html/help-libidn/2015-07/msg00026.html (regression)",
              "https://usn.ubuntu.com/usn/usn-3068-1"
            ],
            "Description": "The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2059",
            "InstalledVersion": "1.28-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libidn: Out-of-bounds read due to use of fgets with fixed-size buffer",
            "PkgName": "libidn",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=570e68886c41c2e765e6218cb317d9a9a447a041",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00005.html",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html",
              "http://www.debian.org/security/2016/dsa-3658",
              "http://www.openwall.com/lists/oss-security/2016/07/20/6",
              "http://www.openwall.com/lists/oss-security/2016/07/21/4",
              "http://www.securityfocus.com/bid/92070",
              "http://www.ubuntu.com/usn/USN-3068-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8948",
              "https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html",
              "https://marc.info/?l=oss-security&m=146910769415616&w=2",
              "https://usn.ubuntu.com/usn/usn-3068-1"
            ],
            "Description": "idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8948",
            "InstalledVersion": "1.28-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libidn: Out of bounds stack read in idna_to_ascii_4i",
            "PkgName": "libidn",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=f20ce1128fb7f4d33297eee307dddaf0f92ac72d",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html",
              "http://www.debian.org/security/2016/dsa-3658",
              "http://www.openwall.com/lists/oss-security/2016/07/20/6",
              "http://www.openwall.com/lists/oss-security/2016/07/21/4",
              "http://www.securityfocus.com/bid/92070",
              "http://www.ubuntu.com/usn/USN-3068-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6261",
              "https://lists.gnu.org/archive/html/help-libidn/2015-07/msg00016.html",
              "https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html",
              "https://usn.ubuntu.com/usn/usn-3068-1"
            ],
            "Description": "The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6261",
            "InstalledVersion": "1.28-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libidn: Out-of-bounds read when reading zero byte as input",
            "PkgName": "libidn",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=5e3cb9c7b5bf0ce665b9d68f5ddf095af5c9ba60",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00005.html",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html",
              "http://www.openwall.com/lists/oss-security/2016/07/20/6",
              "http://www.openwall.com/lists/oss-security/2016/07/21/4",
              "http://www.securityfocus.com/bid/92070",
              "http://www.ubuntu.com/usn/USN-3068-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6262",
              "https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html",
              "https://usn.ubuntu.com/usn/usn-3068-1"
            ],
            "Description": "idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6262",
            "InstalledVersion": "1.28-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libidn: Crash when given invalid UTF-8 data on input",
            "PkgName": "libidn",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=1fbee57ef3c72db2206dd87e4162108b2f425555",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00005.html",
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html",
              "http://www.debian.org/security/2016/dsa-3658",
              "http://www.openwall.com/lists/oss-security/2016/07/20/6",
              "http://www.openwall.com/lists/oss-security/2016/07/21/4",
              "http://www.securityfocus.com/bid/92070",
              "http://www.ubuntu.com/usn/USN-3068-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6263",
              "https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html",
              "https://security.gentoo.org/glsa/201908-06",
              "https://usn.ubuntu.com/usn/usn-3068-1"
            ],
            "Description": "The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6263",
            "InstalledVersion": "1.28-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libidn2: Integer overflow in puny_decode.c/decode_digit",
            "PkgName": "libidn",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2017/dsa-3988",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14062",
              "https://gitlab.com/libidn/libidn2/blob/master/NEWS",
              "https://gitlab.com/libidn/libidn2/commit/3284eb342cd0ed1a18786e3fcdf0cdd7e76676bd",
              "https://lists.debian.org/debian-lts-announce/2018/07/msg00040.html",
              "https://usn.ubuntu.com/usn/usn-3421-1",
              "https://usn.ubuntu.com/usn/usn-3434-1",
              "https://usn.ubuntu.com/usn/usn-3434-2"
            ],
            "Description": "Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-14062",
            "InstalledVersion": "1.28-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: NULL pointer de-reference and use-after-free in Samba AD DC LDAP Server with ASQ, VLV and paged_results",
            "PkgName": "libldb",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1849489;",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10730",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6YLNQ5GRXUKYRUAOFZ4DUBVN4SMTL6Q2/",
              "https://security.gentoo.org/glsa/202007-15",
              "https://usn.ubuntu.com/usn/usn-4409-1",
              "https://www.samba.org/samba/security/CVE-2020-10730.html"
            ],
            "Description": "A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package. This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference. The highest threat from this vulnerability is to system availability.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10730",
            "InstalledVersion": "1.4.2-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: command injection flaw in blkid",
            "PkgName": "libmount",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html",
              "http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html",
              "http://www.openwall.com/lists/oss-security/2014/11/26/21",
              "http://www.securityfocus.com/bid/71327",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1168485",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9114",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/98993",
              "https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc",
              "https://security.gentoo.org/glsa/201612-14"
            ],
            "Description": "Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9114",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 8.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: runuser tty hijack via TIOCSTI ioctl",
            "PkgName": "libmount",
            "Severity": "MEDIUM",
            "References": [
              "http://marc.info/?l=util-linux-ng&m=145694736107128&w=2",
              "http://www.openwall.com/lists/oss-security/2016/02/27/1",
              "http://www.openwall.com/lists/oss-security/2016/02/27/2",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2779"
            ],
            "Description": "runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2779",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "colcrt: global-buffer-overflow",
            "PkgName": "libmount",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00035.html",
              "http://www.spinics.net/lists/util-linux-ng/msg11873.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1259322",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5218",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec",
              "https://www.kernel.org/pub/linux/utils/util-linux/v2.27/v2.27-ReleaseNotes"
            ],
            "Description": "Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5218",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: integer overflow flaws in libgfortran",
            "PkgName": "libquadmath",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2014/07/23/7",
              "http://www.openwall.com/lists/oss-security/2014/07/24/1",
              "http://www.openwall.com/lists/oss-security/2014/07/31/6",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1122812",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5044",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/94849",
              "https://gcc.gnu.org/viewcvs/gcc/trunk/libgfortran/ChangeLog?limit_changes=0&view=markup&pathrev=211721",
              "https://gcc.gnu.org/viewcvs/gcc?limit_changes=0&view=revision&revision=211721"
            ],
            "Description": "Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5044",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Integer overflow in demangle_template() function",
            "PkgName": "libquadmath",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/106454",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24039"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for \"Create an array for saving the template argument values\") that can trigger a heap-based buffer overflow, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20673",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling",
            "PkgName": "libquadmath",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16276.html",
              "http://linux.oracle.com/errata/ELSA-2020-0329.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html",
              "https://access.redhat.com/errata/RHSA-2020:0101",
              "https://access.redhat.com/errata/RHSA-2020:0329",
              "https://access.redhat.com/errata/RHSA-2020:0652",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276",
              "https://github.com/golang/go/issues/34540",
              "https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/",
              "https://security.netapp.com/advisory/ntap-20191122-0004/"
            ],
            "Description": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs",
            "PkgName": "libquadmath",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-16845.html",
              "http://linux.oracle.com/errata/ELSA-2020-5828.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845",
              "https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo",
              "https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q",
              "https://groups.google.com/g/golang-announce/c/NyPIaucMgXo",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/",
              "https://security.netapp.com/advisory/ntap-20200924-0002/"
            ],
            "Description": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-16845",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS",
            "PkgName": "libquadmath",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html",
              "http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html",
              "http://seclists.org/fulldisclosure/2020/Sep/5",
              "https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/",
              "https://security.netapp.com/advisory/ntap-20200924-0003/",
              "https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting"
            ],
            "Description": "Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-24553",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Predictable randomness from std::random_device",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html",
              "http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html",
              "http://www.securitytracker.com/id/1034375",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1262846",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5276",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142",
              "https://gcc.gnu.org/ml/gcc-patches/2015-09/msg01050.html"
            ],
            "Description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Exploitable buffer overflow",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2226",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1",
              "https://www.exploit-db.com/exploits/42386/"
            ],
            "Description": "Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2226",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array btypevec",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4487",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4487",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array ktypevec",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4488",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"ktypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4488",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to integer overflow",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4489",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70492",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the \"demangling of virtual tables.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4489",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Write access violation",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90019",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4490",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70498",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4490",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Stack overflow due to infinite recursion in d_print_comp",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90016",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4491",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70909",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00105.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having \"itself as ancestor more than once.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4491",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 4.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4492",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4492",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4493",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4493",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Memory leak in demangle_template function resulting in a denial of service",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20657.html",
              "http://linux.oracle.com/errata/ELSA-2019-3352.html",
              "http://www.securityfocus.com/bid/106444",
              "https://access.redhat.com/errata/RHSA-2019:3352",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20657",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539",
              "https://support.f5.com/csp/article/K62602089"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20657",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: integer overflow in simple-object-elf.c leads to a heap-based buffer overflow",
            "PkgName": "libquadmath",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html",
              "http://www.securityfocus.com/bid/109354",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14250",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924",
              "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20190822-0002/",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14250",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.6,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "librabbitmq: integer overflow in amqp_handle_input in amqp_connection.c leads to heap-based buffer overflow",
            "PkgName": "librabbitmq",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-18609.html",
              "http://linux.oracle.com/errata/ELSA-2020-3949.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18609",
              "https://github.com/alanxz/rabbitmq-c/blob/master/ChangeLog.md",
              "https://github.com/alanxz/rabbitmq-c/commit/fc85be7123050b91b054e45b91c78d3241a5047a",
              "https://lists.debian.org/debian-lts-announce/2019/12/msg00004.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WA7CPNVYMF6OQNIYNLWUY6U2GTKFOKH3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQER6XTKYMHNQR7QTHW7DJAH645WQROU/",
              "https://news.ycombinator.com/item?id=21681976",
              "https://security.gentoo.org/glsa/202003-07",
              "https://usn.ubuntu.com/4214-1/",
              "https://usn.ubuntu.com/4214-2/",
              "https://usn.ubuntu.com/usn/usn-4214-1",
              "https://usn.ubuntu.com/usn/usn-4214-2"
            ],
            "Description": "An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memory corruption in the handling of CONNECTION_STATE_HEADER. A rogue server could return a malicious frame header that leads to a smaller target_size value than needed. This condition is then carried on to a memcpy function that copies too much data into a heap buffer.",
            "FixedVersion": "0.8.0-3.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18609",
            "InstalledVersion": "0.8.0-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: command injection flaw in blkid",
            "PkgName": "libsmartcols",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html",
              "http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html",
              "http://www.openwall.com/lists/oss-security/2014/11/26/21",
              "http://www.securityfocus.com/bid/71327",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1168485",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9114",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/98993",
              "https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc",
              "https://security.gentoo.org/glsa/201612-14"
            ],
            "Description": "Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9114",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 8.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: runuser tty hijack via TIOCSTI ioctl",
            "PkgName": "libsmartcols",
            "Severity": "MEDIUM",
            "References": [
              "http://marc.info/?l=util-linux-ng&m=145694736107128&w=2",
              "http://www.openwall.com/lists/oss-security/2016/02/27/1",
              "http://www.openwall.com/lists/oss-security/2016/02/27/2",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2779"
            ],
            "Description": "runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2779",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "colcrt: global-buffer-overflow",
            "PkgName": "libsmartcols",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00035.html",
              "http://www.spinics.net/lists/util-linux-ng/msg11873.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1259322",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5218",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec",
              "https://www.kernel.org/pub/linux/utils/util-linux/v2.27/v2.27-ReleaseNotes"
            ],
            "Description": "Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5218",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: ext2fs_open2() missing first_meta_bg boundary check leading to heap buffer overflow (oCERT-015-002)",
            "PkgName": "libss",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0061.html",
              "http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:045",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.ocert.org/advisories/ocert-2015-002.html",
              "http://www.securityfocus.com/archive/1/534633/100/0/threaded",
              "http://www.securityfocus.com/bid/72520",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1187032",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0247",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/100740",
              "https://security.gentoo.org/glsa/201701-06",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-0247",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Crafted ext4 partition leads to out-of-bounds write",
            "PkgName": "libss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5094.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://seclists.org/bugtraq/2019/Sep/58",
              "https://security.gentoo.org/glsa/202003-05",
              "https://security.netapp.com/advisory/ntap-20200115-0002/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
              "https://usn.ubuntu.com/4142-1/",
              "https://usn.ubuntu.com/4142-2/",
              "https://usn.ubuntu.com/usn/usn-4142-1",
              "https://usn.ubuntu.com/usn/usn-4142-2",
              "https://www.debian.org/security/2019/dsa-4535"
            ],
            "Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5094",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: Out-of-bounds write in e2fsck/rehash.c",
            "PkgName": "libss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-5188.html",
              "http://linux.oracle.com/errata/ELSA-2020-4011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
              "https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
              "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973",
              "https://usn.ubuntu.com/4249-1/",
              "https://usn.ubuntu.com/usn/usn-4249-1"
            ],
            "Description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
            "FixedVersion": "1.42.9-19.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5188",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "e2fsprogs: potential buffer overflow in closefs() (incomplete CVE-2015-0247 fix)",
            "PkgName": "libss",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2015-0088.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00006.html",
              "http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html",
              "http://www.debian.org/security/2015/dsa-3166",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:067",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:068",
              "http://www.securityfocus.com/bid/72709",
              "http://www.ubuntu.com/usn/USN-2507-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1572",
              "https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73",
              "https://security.gentoo.org/glsa/201507-22",
              "https://usn.ubuntu.com/usn/usn-2507-1"
            ],
            "Description": "Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-1572",
            "InstalledVersion": "1.42.9-16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libssh2: integer overflow in kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c leads to out-of-bounds write",
            "PkgName": "libssh2",
            "Severity": "MEDIUM",
            "References": [
              "https://blog.semmle.com/libssh2-integer-overflow/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13115",
              "https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa",
              "https://github.com/libssh2/libssh2/pull/350",
              "https://libssh2.org/changes.html",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/",
              "https://security.netapp.com/advisory/ntap-20190806-0002/",
              "https://support.f5.com/csp/article/K13322484",
              "https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp;utm_medium=RSS"
            ],
            "Description": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13115",
            "InstalledVersion": "1.8.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c",
            "PkgName": "libssh2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17498.html",
              "http://linux.oracle.com/errata/ELSA-2020-3915.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html",
              "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17498",
              "https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498",
              "https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480",
              "https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c",
              "https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/"
            ],
            "Description": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.",
            "FixedVersion": "1.8.0-4.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17498",
            "InstalledVersion": "1.8.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libssh2: Unchecked use of _libssh2_packet_require and _libssh2_packet_requirev resulting in out-of-bounds read",
            "PkgName": "libssh2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00102.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00103.html",
              "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html",
              "http://www.openwall.com/lists/oss-security/2019/03/18/3",
              "http://www.securityfocus.com/bid/107485",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3859",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3859",
              "https://github.com/libssh2/libssh2/pull/315",
              "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00006.html",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/",
              "https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00102.html",
              "https://seclists.org/bugtraq/2019/Apr/25",
              "https://seclists.org/bugtraq/2019/Mar/25",
              "https://security.netapp.com/advisory/ntap-20190327-0005/",
              "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767",
              "https://www.debian.org/security/2019/dsa-4431",
              "https://www.libssh2.org/CVE-2019-3859.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            ],
            "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-3859",
            "InstalledVersion": "1.8.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libssh2: Out-of-bounds reads with specially crafted SFTP packets",
            "PkgName": "libssh2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3860",
              "https://github.com/libssh2/libssh2/pull/316",
              "https://libssh2.org/CVE-2019-3860.html",
              "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
              "https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
              "https://seclists.org/bugtraq/2019/Apr/25",
              "https://security.netapp.com/advisory/ntap-20190327-0005/",
              "https://www.debian.org/security/2019/dsa-4431",
              "https://www.libssh2.org/CVE-2019-3860.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
            ],
            "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-3860",
            "InstalledVersion": "1.8.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: integer overflow flaws in libgfortran",
            "PkgName": "libstdc++",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2014/07/23/7",
              "http://www.openwall.com/lists/oss-security/2014/07/24/1",
              "http://www.openwall.com/lists/oss-security/2014/07/31/6",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1122812",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5044",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/94849",
              "https://gcc.gnu.org/viewcvs/gcc/trunk/libgfortran/ChangeLog?limit_changes=0&view=markup&pathrev=211721",
              "https://gcc.gnu.org/viewcvs/gcc?limit_changes=0&view=revision&revision=211721"
            ],
            "Description": "Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5044",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Integer overflow in demangle_template() function",
            "PkgName": "libstdc++",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/106454",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20673",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=24039"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for \"Create an array for saving the template argument values\") that can trigger a heap-based buffer overflow, as demonstrated by nm.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20673",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling",
            "PkgName": "libstdc++",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16276.html",
              "http://linux.oracle.com/errata/ELSA-2020-0329.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html",
              "https://access.redhat.com/errata/RHSA-2020:0101",
              "https://access.redhat.com/errata/RHSA-2020:0329",
              "https://access.redhat.com/errata/RHSA-2020:0652",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16276",
              "https://github.com/golang/go/issues/34540",
              "https://groups.google.com/forum/#!msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/",
              "https://security.netapp.com/advisory/ntap-20191122-0004/"
            ],
            "Description": "Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs",
            "PkgName": "libstdc++",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-16845.html",
              "http://linux.oracle.com/errata/ELSA-2020-5828.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845",
              "https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo",
              "https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q",
              "https://groups.google.com/g/golang-announce/c/NyPIaucMgXo",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/",
              "https://security.netapp.com/advisory/ntap-20200924-0002/"
            ],
            "Description": "Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-16845",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS",
            "PkgName": "libstdc++",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html",
              "http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html",
              "http://seclists.org/fulldisclosure/2020/Sep/5",
              "https://groups.google.com/forum/#!topic/golang-announce/8wqlSbkLdPs",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/",
              "https://security.netapp.com/advisory/ntap-20200924-0003/",
              "https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-004/-inconsistent-behavior-of-gos-cgi-and-fastcgi-transport-may-lead-to-cross-site-scripting"
            ],
            "Description": "Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-24553",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Predictable randomness from std::random_device",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00054.html",
              "http://lists.opensuse.org/opensuse-updates/2016-04/msg00052.html",
              "http://www.securitytracker.com/id/1034375",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1262846",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5276",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65142",
              "https://gcc.gnu.org/ml/gcc-patches/2015-09/msg01050.html"
            ],
            "Description": "The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5276",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 3.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Exploitable buffer overflow",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90103",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2226",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69687",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1",
              "https://www.exploit-db.com/exploits/42386/"
            ],
            "Description": "Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which triggers a buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2226",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array btypevec",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4487",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"btypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4487",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.1,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to a use-after-free to array ktypevec",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90025",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4488",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70481",
              "https://gcc.gnu.org/ml/gcc-patches/2016-03/msg01687.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to \"ktypevec.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4488",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Invalid write due to integer overflow",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4489",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70492",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the \"demangling of virtual tables.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4489",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Write access violation",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90019",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4490",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70498",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4490",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Stack overflow due to infinite recursion in d_print_comp",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90016",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4491",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70909",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00105.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having \"itself as ancestor more than once.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4491",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 4.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4492",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4492",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "gcc: Read access violations",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/05/05/5",
              "http://www.securityfocus.com/bid/90014",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4493",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70926",
              "https://gcc.gnu.org/ml/gcc-patches/2016-05/msg00223.html",
              "https://usn.ubuntu.com/usn/usn-3337-1",
              "https://usn.ubuntu.com/usn/usn-3367-1",
              "https://usn.ubuntu.com/usn/usn-3368-1"
            ],
            "Description": "The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4493",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "libiberty: Memory leak in demangle_template function resulting in a denial of service",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20657.html",
              "http://linux.oracle.com/errata/ELSA-2019-3352.html",
              "http://www.securityfocus.com/bid/106444",
              "https://access.redhat.com/errata/RHSA-2019:3352",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20657",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539",
              "https://support.f5.com/csp/article/K62602089"
            ],
            "Description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20657",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "binutils: integer overflow in simple-object-elf.c leads to a heap-based buffer overflow",
            "PkgName": "libstdc++",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html",
              "http://www.securityfocus.com/bid/109354",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14250",
              "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924",
              "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html",
              "https://security.gentoo.org/glsa/202007-39",
              "https://security.netapp.com/advisory/ntap-20190822-0002/",
              "https://usn.ubuntu.com/4326-1/",
              "https://usn.ubuntu.com/4336-1/",
              "https://usn.ubuntu.com/usn/usn-4326-1",
              "https://usn.ubuntu.com/usn/usn-4336-1"
            ],
            "Description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14250",
            "InstalledVersion": "4.8.5-39.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libtasn1: infinite loop while parsing DER certificates",
            "PkgName": "libtasn1",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625",
              "http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=f435825c0f527a8e52e6ffbc3ad0bc60531d537e",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html",
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html",
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html",
              "http://www.debian.org/security/2016/dsa-3568",
              "http://www.openwall.com/lists/oss-security/2016/04/11/3",
              "http://www.ubuntu.com/usn/USN-2957-1",
              "http://www.ubuntu.com/usn/USN-2957-2",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4008",
              "https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html",
              "https://security.gentoo.org/glsa/201703-05",
              "https://usn.ubuntu.com/usn/usn-2957-1",
              "https://usn.ubuntu.com/usn/usn-2957-2"
            ],
            "Description": "The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4008",
            "InstalledVersion": "4.10-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libtasn1: Stack exhaustion due to indefinite recursion during BER decoding",
            "PkgName": "libtasn1",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.nongnu.org/cgit/libtasn1.git/commit/?id=c593ae84cfcde8fea45787e53950e0ac71e9ca97",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1535926",
              "https://bugzilla.suse.com/show_bug.cgi?id=1076832",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6003",
              "https://gitlab.com/gnutls/libtasn1/commit/946565d8eb05fbf7970ea366e817581bb5a90910",
              "https://usn.ubuntu.com/usn/usn-3547-1",
              "https://www.debian.org/security/2018/dsa-4106"
            ],
            "Description": "An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited recursion in the BER decoder leads to stack exhaustion and DoS.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6003",
            "InstalledVersion": "4.10-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libtasn1: NULL pointer dereference in the _asn1_check_identifier function",
            "PkgName": "libtasn1",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464141",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10790",
              "https://lists.debian.org/debian-lts-announce/2020/06/msg00026.html",
              "https://security.gentoo.org/glsa/201710-11",
              "https://usn.ubuntu.com/3547-1/",
              "https://usn.ubuntu.com/usn/usn-3547-1",
              "https://www.debian.org/security/2018/dsa-4106"
            ],
            "Description": "The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10790",
            "InstalledVersion": "4.10-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libtasn1: Stack-based buffer overflow in asn1_find_node()",
            "PkgName": "libtasn1",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;h=5520704d075802df25ce4ffccc010ba1641bd484",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html",
              "http://www.debian.org/security/2017/dsa-3861",
              "http://www.securityfocus.com/bid/98641",
              "http://www.securitytracker.com/id/1038619",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6891",
              "https://secuniaresearch.flexerasoftware.com/advisories/76125/",
              "https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/",
              "https://security.gentoo.org/glsa/201710-11",
              "https://usn.ubuntu.com/usn/usn-3309-1",
              "https://usn.ubuntu.com/usn/usn-3309-2"
            ],
            "Description": "Two errors in the \"asn1_find_node()\" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6891",
            "InstalledVersion": "4.10-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libtasn1: Infinite loop in _asn1_expand_object_id(ptree) leads to memory exhaustion",
            "PkgName": "libtasn1",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html",
              "http://www.securityfocus.com/bid/105151",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000654",
              "https://gitlab.com/gnutls/libtasn1/issues/4"
            ],
            "Description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1000654",
            "InstalledVersion": "4.10-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 2.6,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "glibc: libtirpc: stack (frame) overflow in Sun RPC clntudp_call()",
            "PkgName": "libtirpc",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html",
              "http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
              "http://www.securityfocus.com/bid/102073",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4429",
              "https://lists.debian.org/debian-lts-announce/2020/06/msg00027.html",
              "https://source.android.com/security/bulletin/2017-12-01",
              "https://sourceware.org/bugzilla/show_bug.cgi?id=20112",
              "https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=bc779a1a5b3035133024b21e2f339fe4219fb11c",
              "https://usn.ubuntu.com/3759-1/",
              "https://usn.ubuntu.com/3759-2/",
              "https://usn.ubuntu.com/usn/usn-3239-1",
              "https://usn.ubuntu.com/usn/usn-3759-1",
              "https://usn.ubuntu.com/usn/usn-3759-2"
            ],
            "Description": "Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4429",
            "InstalledVersion": "0.2.4-0.16.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: command injection flaw in blkid",
            "PkgName": "libuuid",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html",
              "http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html",
              "http://www.openwall.com/lists/oss-security/2014/11/26/21",
              "http://www.securityfocus.com/bid/71327",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1168485",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9114",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/98993",
              "https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc",
              "https://security.gentoo.org/glsa/201612-14"
            ],
            "Description": "Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9114",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 8.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: runuser tty hijack via TIOCSTI ioctl",
            "PkgName": "libuuid",
            "Severity": "MEDIUM",
            "References": [
              "http://marc.info/?l=util-linux-ng&m=145694736107128&w=2",
              "http://www.openwall.com/lists/oss-security/2016/02/27/1",
              "http://www.openwall.com/lists/oss-security/2016/02/27/2",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2779"
            ],
            "Description": "runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2779",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "colcrt: global-buffer-overflow",
            "PkgName": "libuuid",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00035.html",
              "http://www.spinics.net/lists/util-linux-ng/msg11873.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1259322",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5218",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec",
              "https://www.kernel.org/pub/linux/utils/util-linux/v2.27/v2.27-ReleaseNotes"
            ],
            "Description": "Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5218",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 9.3,
                "V3Score": 10,
                "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 9.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Samba: Netlogon Elevation of Privilege Vulnerability (Zerologon)",
            "PkgName": "libwbclient",
            "Severity": "CRITICAL",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html",
              "http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html",
              "http://www.openwall.com/lists/oss-security/2020/09/17/2",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472",
              "https://kb.cert.org/vuls/id/490028#Samba",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/",
              "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472",
              "https://usn.ubuntu.com/4510-1/",
              "https://usn.ubuntu.com/4510-2/",
              "https://usn.ubuntu.com/4559-1/",
              "https://usn.ubuntu.com/usn/usn-4510-1",
              "https://usn.ubuntu.com/usn/usn-4510-2",
              "https://www.kb.cert.org/vuls/id/490028",
              "https://www.samba.org/samba/security/CVE-2020-1472.html",
              "https://www.secura.com/pathtoimg.php?id=2055",
              "https://www.synology.com/security/advisory/Synology_SA_20_21"
            ],
            "Description": "An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1472",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Combination of parameters and permissions can allow user to escape from the share path definition",
            "PkgName": "libwbclient",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10197.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html",
              "https://access.redhat.com/errata/RHSA-2019:3253",
              "https://access.redhat.com/errata/RHSA-2019:4023",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10197",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/",
              "https://seclists.org/bugtraq/2019/Sep/4",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20190903-0001/",
              "https://support.f5.com/csp/article/K69511801",
              "https://support.f5.com/csp/article/K69511801?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4121-1/",
              "https://usn.ubuntu.com/usn/usn-4121-1",
              "https://www.debian.org/security/2019/dsa-4513",
              "https://www.samba.org/samba/security/CVE-2019-10197.html"
            ],
            "Description": "A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10197",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: smb client vulnerable to filenames containing path separators",
            "PkgName": "libwbclient",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10218.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10218",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/",
              "https://usn.ubuntu.com/usn/usn-4167-1",
              "https://usn.ubuntu.com/usn/usn-4167-2",
              "https://www.samba.org/samba/security/CVE-2019-10218.html",
              "https://www.synology.com/security/advisory/Synology_SA_19_35"
            ],
            "Description": "A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10218",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Crash after failed character conversion at log level 3 or above",
            "PkgName": "libwbclient",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14907.html",
              "http://linux.oracle.com/errata/ELSA-2020-3981.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14907",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20200122-0001/",
              "https://usn.ubuntu.com/4244-1/",
              "https://usn.ubuntu.com/usn/usn-4244-1",
              "https://www.samba.org/samba/security/CVE-2019-14907.html",
              "https://www.synology.com/security/advisory/Synology_SA_20_01"
            ],
            "Description": "All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with \"log level = 3\" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).",
            "FixedVersion": "4.10.16-5.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14907",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Use after free triggered by XPointer paths beginning with range-to",
            "PkgName": "libxml2",
            "Severity": "HIGH",
            "References": [
              "http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html",
              "http://linux.oracle.com/cve/CVE-2016-5131.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1485.html",
              "http://www.debian.org/security/2016/dsa-3637",
              "http://www.securityfocus.com/bid/92053",
              "http://www.securitytracker.com/id/1036428",
              "http://www.securitytracker.com/id/1038623",
              "http://www.ubuntu.com/usn/USN-3041-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1358641",
              "https://codereview.chromium.org/2127493002",
              "https://crbug.com/623378",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131",
              "https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html",
              "https://security.gentoo.org/glsa/201610-09",
              "https://security.gentoo.org/glsa/201701-37",
              "https://source.android.com/security/bulletin/2017-05-01",
              "https://support.apple.com/HT207141",
              "https://support.apple.com/HT207142",
              "https://support.apple.com/HT207143",
              "https://support.apple.com/HT207170",
              "https://usn.ubuntu.com/usn/usn-3041-1",
              "https://usn.ubuntu.com/usn/usn-3235-1"
            ],
            "Description": "Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-5131",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c",
            "PkgName": "libxml2",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2017-15412.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://www.securitytracker.com/id/1040348",
              "https://access.redhat.com/errata/RHSA-2017:3401",
              "https://access.redhat.com/errata/RHSA-2018:0287",
              "https://bugzilla.gnome.org/show_bug.cgi?id=783160",
              "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html",
              "https://crbug.com/727039",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412",
              "https://github.com/sparklemotion/nokogiri/issues/1714",
              "https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html",
              "https://security.gentoo.org/glsa/201801-03",
              "https://usn.ubuntu.com/usn/usn-3513-1",
              "https://usn.ubuntu.com/usn/usn-3513-1/",
              "https://usn.ubuntu.com/usn/usn-3513-2",
              "https://www.debian.org/security/2018/dsa-4086"
            ],
            "Description": "Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15412",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: DoS caused by incorrect error detection during XZ decompression",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-8035.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html",
              "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html",
              "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1089.html",
              "http://www.debian.org/security/2015/dsa-3430",
              "http://www.openwall.com/lists/oss-security/2015/11/02/2",
              "http://www.openwall.com/lists/oss-security/2015/11/02/4",
              "http://www.openwall.com/lists/oss-security/2015/11/03/1",
              "http://www.securityfocus.com/bid/77390",
              "http://www.securitytracker.com/id/1034243",
              "http://www.ubuntu.com/usn/USN-2812-1",
              "http://xmlsoft.org/news.html",
              "https://bugzilla.gnome.org/show_bug.cgi?id=757466",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380",
              "https://security.gentoo.org/glsa/201701-37",
              "https://support.apple.com/HT206166",
              "https://support.apple.com/HT206167",
              "https://support.apple.com/HT206168",
              "https://support.apple.com/HT206169",
              "https://usn.ubuntu.com/usn/usn-2812-1"
            ],
            "Description": "The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8035",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: out-of-bounds read",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
              "http://www.debian.org/security/2016/dsa-3593",
              "http://www.openwall.com/lists/oss-security/2016/05/03/8",
              "http://www.openwall.com/lists/oss-security/2016/05/04/7",
              "http://www.openwall.com/lists/oss-security/2016/06/07/4",
              "http://www.openwall.com/lists/oss-security/2016/06/07/5",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/90013",
              "http://www.securitytracker.com/id/1036348",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483",
              "https://git.gnome.org/browse/libxml2/commit/?id=c97750d11bb8b6f3303e7131fe526a61ac65bcfd",
              "https://security.gentoo.org/glsa/201701-37",
              "https://usn.ubuntu.com/usn/usn-2994-1",
              "https://www.tenable.com/security/tns-2016-18"
            ],
            "Description": "The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.  NOTE: this vulnerability may be a duplicate of CVE-2016-3627.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4483",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 10,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Use after free via namespace node in XPointer ranges",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html",
              "http://www.securityfocus.com/bid/93054",
              "http://www.securitytracker.com/id/1036858",
              "http://www.securitytracker.com/id/1038623",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658",
              "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b",
              "https://github.com/advisories/GHSA-fr52-4hqw-p27f",
              "https://github.com/sparklemotion/nokogiri/issues/1615",
              "https://nvd.nist.gov/vuln/detail/CVE-2016-4658",
              "https://security.gentoo.org/glsa/201701-37",
              "https://support.apple.com/HT207141",
              "https://support.apple.com/HT207142",
              "https://support.apple.com/HT207143",
              "https://support.apple.com/HT207170",
              "https://usn.ubuntu.com/usn/usn-3235-1"
            ],
            "Description": "xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4658",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 5.8,
                "V3Score": 6.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: XML External Entity vulnerability",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/94347",
              "https://bugzilla.gnome.org/show_bug.cgi?id=772726",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318",
              "https://github.com/lsh123/xmlsec/issues/43",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/3739-2/",
              "https://usn.ubuntu.com/usn/usn-3739-1",
              "https://usn.ubuntu.com/usn/usn-3739-2"
            ],
            "Description": "libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9318",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Heap buffer overflow in xmlAddID",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.securityfocus.com/bid/98877",
              "http://www.securitytracker.com/id/1038623",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0663",
              "https://security.gentoo.org/glsa/201711-01",
              "https://source.android.com/security/bulletin/2017-06-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-0663",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Mishandling parameter-entity references",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://xmlsoft.org/news.html",
              "https://bugzilla.gnome.org/show_bug.cgi?id=766956",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16931",
              "https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html"
            ],
            "Description": "parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16931",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Infinite recursion in parameter entities",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://xmlsoft.org/news.html",
              "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html",
              "https://bugzilla.gnome.org/show_bug.cgi?id=759579",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932",
              "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961",
              "https://github.com/sparklemotion/nokogiri/issues/1714",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/usn/usn-3504-1",
              "https://usn.ubuntu.com/usn/usn-3504-1/",
              "https://usn.ubuntu.com/usn/usn-3504-2",
              "https://usn.ubuntu.com/usn/usn-3739-1"
            ],
            "Description": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16932",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Missing validation for external entities in xmlParsePEReference",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/98877",
              "http://www.securitytracker.com/id/1038623",
              "https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1462203",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375",
              "https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e",
              "https://security.gentoo.org/glsa/201711-01",
              "https://source.android.com/security/bulletin/2017-06-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2",
              "https://www.debian.org/security/2017/dsa-3952"
            ],
            "Description": "A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7375",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Buffer overflow in function xmlSnprintfElementContent",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98599",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9047",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about \"size\" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9047",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Heap-based buffer over-read in function xmlDictComputeFastKey",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98601",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9049",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9049",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Heap-based buffer over-read in function xmlDictAddString",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98568",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9050",
              "https://github.com/advisories/GHSA-8c56-cpmw-89x7",
              "https://github.com/sparklemotion/nokogiri/issues/1673",
              "https://nvd.nist.gov/vuln/detail/CVE-2017-9050",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-1/",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9050",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-14404.html",
              "http://linux.oracle.com/errata/ELSA-2020-1827.html",
              "https://access.redhat.com/errata/RHSA-2019:1543",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1595985",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404",
              "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h",
              "https://github.com/sparklemotion/nokogiri/issues/1785",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594",
              "https://gitlab.gnome.org/GNOME/libxml2/issues/10",
              "https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://nvd.nist.gov/vuln/detail/CVE-2018-14404",
              "https://security.netapp.com/advisory/ntap-20190719-0002/",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/3739-2/",
              "https://usn.ubuntu.com/usn/usn-3739-1",
              "https://usn.ubuntu.com/usn/usn-3739-2"
            ],
            "Description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-14404",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-19956.html",
              "http://linux.oracle.com/errata/ELSA-2020-3996.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549",
              "https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/",
              "https://security.netapp.com/advisory/ntap-20200114-0002/",
              "https://usn.ubuntu.com/4274-1/",
              "https://usn.ubuntu.com/usn/usn-4274-1",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.",
            "FixedVersion": "2.9.1-6.el7.5",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19956",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-20388.html",
              "http://linux.oracle.com/errata/ELSA-2020-3996.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20388",
              "https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/",
              "https://security.netapp.com/advisory/ntap-20200702-0005/",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.",
            "FixedVersion": "2.9.1-6.el7.5",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20388",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Buffer Overflow vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977",
              "https://gitlab.gnome.org/GNOME/libxml2/-/issues/178",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/",
              "https://security.netapp.com/advisory/ntap-20200924-0001/"
            ],
            "Description": "GNOME project libxml2 v2.9.10 and earlier have a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 8e7c20a1 (20910-GITv2.9.10-103-g8e7c20a1).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-24977",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations",
            "PkgName": "libxml2",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-7595.html",
              "http://linux.oracle.com/errata/ELSA-2020-3996.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595",
              "https://github.com/advisories/GHSA-7553-jr98-vx47",
              "https://github.com/sparklemotion/nokogiri/issues/1992",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/",
              "https://nvd.nist.gov/vuln/detail/CVE-2020-7595",
              "https://security.netapp.com/advisory/ntap-20200702-0005/",
              "https://usn.ubuntu.com/4274-1/",
              "https://usn.ubuntu.com/usn/usn-4274-1",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.",
            "FixedVersion": "2.9.1-6.el7.5",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-7595",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Unrestricted memory usage in xz_head() function in xzlib.c",
            "PkgName": "libxml2",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2017-18258.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258",
              "https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb",
              "https://github.com/advisories/GHSA-882p-jqgm-f45g",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://nvd.nist.gov/vuln/detail/CVE-2017-18258",
              "https://security.netapp.com/advisory/ntap-20190719-0001/",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/usn/usn-3739-1"
            ],
            "Description": "The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18258",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 4.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Null pointer dereference in xmlSaveDoc implementation",
            "PkgName": "libxml2",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/11/05/3",
              "http://www.openwall.com/lists/oss-security/2017/02/13/1",
              "http://www.securityfocus.com/bid/96188",
              "https://bugzilla.gnome.org/show_bug.cgi?id=778519",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5969",
              "https://security.gentoo.org/glsa/201711-01"
            ],
            "Description": "** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states \"I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-5969",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Out-of-bounds read in htmlParseTryOrFinish",
            "PkgName": "libxml2",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.gnome.org/show_bug.cgi?id=775200",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8872",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
            ],
            "Description": "The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8872",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Stack-based buffer overflow in function xmlSnprintfElementContent",
            "PkgName": "libxml2",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98556",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9048",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9048",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Infinite loop caused by incorrect error detection during LZMA decompression",
            "PkgName": "libxml2",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-14567.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://www.securityfocus.com/bid/105198",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14567",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/usn/usn-3739-1"
            ],
            "Description": "libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-14567",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Use after free triggered by XPointer paths beginning with range-to",
            "PkgName": "libxml2-python",
            "Severity": "HIGH",
            "References": [
              "http://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html",
              "http://linux.oracle.com/cve/CVE-2016-5131.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00020.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00028.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1485.html",
              "http://www.debian.org/security/2016/dsa-3637",
              "http://www.securityfocus.com/bid/92053",
              "http://www.securitytracker.com/id/1036428",
              "http://www.securitytracker.com/id/1038623",
              "http://www.ubuntu.com/usn/USN-3041-1",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1358641",
              "https://codereview.chromium.org/2127493002",
              "https://crbug.com/623378",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131",
              "https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html",
              "https://security.gentoo.org/glsa/201610-09",
              "https://security.gentoo.org/glsa/201701-37",
              "https://source.android.com/security/bulletin/2017-05-01",
              "https://support.apple.com/HT207141",
              "https://support.apple.com/HT207142",
              "https://support.apple.com/HT207143",
              "https://support.apple.com/HT207170",
              "https://usn.ubuntu.com/usn/usn-3041-1",
              "https://usn.ubuntu.com/usn/usn-3235-1"
            ],
            "Description": "Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-5131",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c",
            "PkgName": "libxml2-python",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2017-15412.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://www.securitytracker.com/id/1040348",
              "https://access.redhat.com/errata/RHSA-2017:3401",
              "https://access.redhat.com/errata/RHSA-2018:0287",
              "https://bugzilla.gnome.org/show_bug.cgi?id=783160",
              "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html",
              "https://crbug.com/727039",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412",
              "https://github.com/sparklemotion/nokogiri/issues/1714",
              "https://lists.debian.org/debian-lts-announce/2017/12/msg00014.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15412.html",
              "https://security.gentoo.org/glsa/201801-03",
              "https://usn.ubuntu.com/usn/usn-3513-1",
              "https://usn.ubuntu.com/usn/usn-3513-1/",
              "https://usn.ubuntu.com/usn/usn-3513-2",
              "https://www.debian.org/security/2018/dsa-4086"
            ],
            "Description": "Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15412",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: DoS caused by incorrect error detection during XZ decompression",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2015-8035.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html",
              "http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177341.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177381.html",
              "http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html",
              "http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html",
              "http://rhn.redhat.com/errata/RHSA-2016-1089.html",
              "http://www.debian.org/security/2015/dsa-3430",
              "http://www.openwall.com/lists/oss-security/2015/11/02/2",
              "http://www.openwall.com/lists/oss-security/2015/11/02/4",
              "http://www.openwall.com/lists/oss-security/2015/11/03/1",
              "http://www.securityfocus.com/bid/77390",
              "http://www.securitytracker.com/id/1034243",
              "http://www.ubuntu.com/usn/USN-2812-1",
              "http://xmlsoft.org/news.html",
              "https://bugzilla.gnome.org/show_bug.cgi?id=757466",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8035",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380",
              "https://security.gentoo.org/glsa/201701-37",
              "https://support.apple.com/HT206166",
              "https://support.apple.com/HT206167",
              "https://support.apple.com/HT206168",
              "https://support.apple.com/HT206169",
              "https://usn.ubuntu.com/usn/usn-2812-1"
            ],
            "Description": "The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8035",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: out-of-bounds read",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://rhn.redhat.com/errata/RHSA-2016-2957.html",
              "http://www.debian.org/security/2016/dsa-3593",
              "http://www.openwall.com/lists/oss-security/2016/05/03/8",
              "http://www.openwall.com/lists/oss-security/2016/05/04/7",
              "http://www.openwall.com/lists/oss-security/2016/06/07/4",
              "http://www.openwall.com/lists/oss-security/2016/06/07/5",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/90013",
              "http://www.securitytracker.com/id/1036348",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4483",
              "https://git.gnome.org/browse/libxml2/commit/?id=c97750d11bb8b6f3303e7131fe526a61ac65bcfd",
              "https://security.gentoo.org/glsa/201701-37",
              "https://usn.ubuntu.com/usn/usn-2994-1",
              "https://www.tenable.com/security/tns-2016-18"
            ],
            "Description": "The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.  NOTE: this vulnerability may be a duplicate of CVE-2016-3627.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4483",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 10,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Use after free via namespace node in XPointer ranges",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html",
              "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html",
              "http://www.securityfocus.com/bid/93054",
              "http://www.securitytracker.com/id/1036858",
              "http://www.securitytracker.com/id/1038623",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658",
              "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b",
              "https://github.com/advisories/GHSA-fr52-4hqw-p27f",
              "https://github.com/sparklemotion/nokogiri/issues/1615",
              "https://nvd.nist.gov/vuln/detail/CVE-2016-4658",
              "https://security.gentoo.org/glsa/201701-37",
              "https://support.apple.com/HT207141",
              "https://support.apple.com/HT207142",
              "https://support.apple.com/HT207143",
              "https://support.apple.com/HT207170",
              "https://usn.ubuntu.com/usn/usn-3235-1"
            ],
            "Description": "xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4658",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 5.8,
                "V3Score": 6.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: XML External Entity vulnerability",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/94347",
              "https://bugzilla.gnome.org/show_bug.cgi?id=772726",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9318",
              "https://github.com/lsh123/xmlsec/issues/43",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/3739-2/",
              "https://usn.ubuntu.com/usn/usn-3739-1",
              "https://usn.ubuntu.com/usn/usn-3739-2"
            ],
            "Description": "libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9318",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Heap buffer overflow in xmlAddID",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.securityfocus.com/bid/98877",
              "http://www.securitytracker.com/id/1038623",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0663",
              "https://security.gentoo.org/glsa/201711-01",
              "https://source.android.com/security/bulletin/2017-06-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-0663",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Mishandling parameter-entity references",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://xmlsoft.org/news.html",
              "https://bugzilla.gnome.org/show_bug.cgi?id=766956",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16931",
              "https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html"
            ],
            "Description": "parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16931",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Infinite recursion in parameter entities",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://xmlsoft.org/news.html",
              "https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html",
              "https://bugzilla.gnome.org/show_bug.cgi?id=759579",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16932",
              "https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961",
              "https://github.com/sparklemotion/nokogiri/issues/1714",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16932.html",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/usn/usn-3504-1",
              "https://usn.ubuntu.com/usn/usn-3504-1/",
              "https://usn.ubuntu.com/usn/usn-3504-2",
              "https://usn.ubuntu.com/usn/usn-3739-1"
            ],
            "Description": "parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16932",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Missing validation for external entities in xmlParsePEReference",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/98877",
              "http://www.securitytracker.com/id/1038623",
              "https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1462203",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375",
              "https://git.gnome.org/browse/libxml2/commit/?id=90ccb58242866b0ba3edbef8fe44214a101c2b3e",
              "https://security.gentoo.org/glsa/201711-01",
              "https://source.android.com/security/bulletin/2017-06-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2",
              "https://www.debian.org/security/2017/dsa-3952"
            ],
            "Description": "A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7375",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Buffer overflow in function xmlSnprintfElementContent",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98599",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9047",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about \"size\" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2, such as PHP, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9047",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Heap-based buffer over-read in function xmlDictComputeFastKey",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98601",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9049",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for libxml2 Bug 759398.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9049",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Heap-based buffer over-read in function xmlDictAddString",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98568",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9050",
              "https://github.com/advisories/GHSA-8c56-cpmw-89x7",
              "https://github.com/sparklemotion/nokogiri/issues/1673",
              "https://nvd.nist.gov/vuln/detail/CVE-2017-9050",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0663.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7375.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-7376.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9047.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9048.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9049.html",
              "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9050.html",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-1/",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9050",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-14404.html",
              "http://linux.oracle.com/errata/ELSA-2020-1827.html",
              "https://access.redhat.com/errata/RHSA-2019:1543",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1595985",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404",
              "https://github.com/advisories/GHSA-6qvp-r6r3-9p7h",
              "https://github.com/sparklemotion/nokogiri/issues/1785",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/a436374994c47b12d5de1b8b1d191a098fa23594",
              "https://gitlab.gnome.org/GNOME/libxml2/issues/10",
              "https://groups.google.com/forum/#!msg/ruby-security-ann/uVrmO2HjqQw/Fw3ocLI0BQAJ",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://nvd.nist.gov/vuln/detail/CVE-2018-14404",
              "https://security.netapp.com/advisory/ntap-20190719-0002/",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/3739-2/",
              "https://usn.ubuntu.com/usn/usn-3739-1",
              "https://usn.ubuntu.com/usn/usn-3739-2"
            ],
            "Description": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-14404",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-19956.html",
              "http://linux.oracle.com/errata/ELSA-2020-3996.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549",
              "https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/",
              "https://security.netapp.com/advisory/ntap-20200114-0002/",
              "https://usn.ubuntu.com/4274-1/",
              "https://usn.ubuntu.com/usn/usn-4274-1",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.",
            "FixedVersion": "2.9.1-6.el7.5",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19956",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-20388.html",
              "http://linux.oracle.com/errata/ELSA-2020-3996.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20388",
              "https://gitlab.gnome.org/GNOME/libxml2/merge_requests/68",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/",
              "https://security.netapp.com/advisory/ntap-20200702-0005/",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.",
            "FixedVersion": "2.9.1-6.el7.5",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20388",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Buffer Overflow vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00036.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24977",
              "https://gitlab.gnome.org/GNOME/libxml2/-/issues/178",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NQ5GTDYOVH26PBCPYXXMGW5ZZXWMGZC/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7KQXOHIE3MNY3VQXEN7LDQUJNIHOVHAW/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3IQ7OQXBKWD3YP7HO6KCNOMLE5ZO2IR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J3ICASXZI2UQYFJAOQWHSTNWGED3VXOE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCHXIWR5DHYO3RSO7RAHEC6VJKXD2EH2/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7MEWYKIKMV2SKMGH4IDWVU3ZGJXBCPQ/",
              "https://security.netapp.com/advisory/ntap-20200924-0001/"
            ],
            "Description": "GNOME project libxml2 v2.9.10 and earlier have a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 8e7c20a1 (20910-GITv2.9.10-103-g8e7c20a1).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-24977",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations",
            "PkgName": "libxml2-python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-7595.html",
              "http://linux.oracle.com/errata/ELSA-2020-3996.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7595",
              "https://github.com/advisories/GHSA-7553-jr98-vx47",
              "https://github.com/sparklemotion/nokogiri/issues/1992",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/",
              "https://nvd.nist.gov/vuln/detail/CVE-2020-7595",
              "https://security.netapp.com/advisory/ntap-20200702-0005/",
              "https://usn.ubuntu.com/4274-1/",
              "https://usn.ubuntu.com/usn/usn-4274-1",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.",
            "FixedVersion": "2.9.1-6.el7.5",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-7595",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Unrestricted memory usage in xz_head() function in xzlib.c",
            "PkgName": "libxml2-python",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2017-18258.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258",
              "https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb",
              "https://github.com/advisories/GHSA-882p-jqgm-f45g",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://nvd.nist.gov/vuln/detail/CVE-2017-18258",
              "https://security.netapp.com/advisory/ntap-20190719-0001/",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/usn/usn-3739-1"
            ],
            "Description": "The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18258",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 4.7,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Null pointer dereference in xmlSaveDoc implementation",
            "PkgName": "libxml2-python",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/11/05/3",
              "http://www.openwall.com/lists/oss-security/2017/02/13/1",
              "http://www.securityfocus.com/bid/96188",
              "https://bugzilla.gnome.org/show_bug.cgi?id=778519",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5969",
              "https://security.gentoo.org/glsa/201711-01"
            ],
            "Description": "** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted XML document.  NOTE: The maintainer states \"I would disagree of a CVE with the Recover parsing option which should only be used for manual recovery at least for XML parser.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-5969",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Out-of-bounds read in htmlParseTryOrFinish",
            "PkgName": "libxml2-python",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.gnome.org/show_bug.cgi?id=775200",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8872",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html"
            ],
            "Description": "The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-8872",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Stack-based buffer overflow in function xmlSnprintfElementContent",
            "PkgName": "libxml2-python",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2017/dsa-3952",
              "http://www.openwall.com/lists/oss-security/2017/05/15/1",
              "http://www.securityfocus.com/bid/98556",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9048",
              "https://security.gentoo.org/glsa/201711-01",
              "https://usn.ubuntu.com/usn/usn-3424-1",
              "https://usn.ubuntu.com/usn/usn-3424-2"
            ],
            "Description": "libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. At the end of the routine, the function may strcat two more characters without checking whether the current strlen(buf) + 2 < size. This vulnerability causes programs that use libxml2, such as PHP, to crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-9048",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "libxml2: Infinite loop caused by incorrect error detection during LZMA decompression",
            "PkgName": "libxml2-python",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-14567.html",
              "http://linux.oracle.com/errata/ELSA-2020-1190.html",
              "http://www.securityfocus.com/bid/105198",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14567",
              "https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e26375100275e74",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html",
              "https://usn.ubuntu.com/3739-1/",
              "https://usn.ubuntu.com/usn/usn-3739-1"
            ],
            "Description": "libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.",
            "FixedVersion": "2.9.1-6.el7.4",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-14567",
            "InstalledVersion": "2.9.1-6.el7_2.3"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 4.4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "lua: overflow flaw in vararg functions",
            "PkgName": "lua",
            "Severity": "MEDIUM",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0414.html",
              "http://lists.opensuse.org/opensuse-updates/2014-09/msg00030.html",
              "http://secunia.com/advisories/59890",
              "http://secunia.com/advisories/60869",
              "http://secunia.com/advisories/61411",
              "http://www.debian.org/security/2014/dsa-3015",
              "http://www.debian.org/security/2014/dsa-3016",
              "http://www.lua.org/bugs.html#5.2.2-1",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:144",
              "http://www.openwall.com/lists/oss-security/2014/08/21/1",
              "http://www.openwall.com/lists/oss-security/2014/08/21/4",
              "http://www.openwall.com/lists/oss-security/2014/08/27/2",
              "http://www.securityfocus.com/bid/69342",
              "http://www.ubuntu.com/usn/USN-2338-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5461",
              "https://security.gentoo.org/glsa/201701-53",
              "https://usn.ubuntu.com/usn/usn-2338-1"
            ],
            "Description": "Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-5461",
            "InstalledVersion": "5.1.4-15.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lvm2: memory leak in vg_lookup in daemons/lvmetad/lvmetad-core.c",
            "PkgName": "lvm2",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8991",
              "https://sourceware.org/git/?p=lvm2.git;a=commit;h=bcf9556b8fcd16ad8997f80cc92785f295c66701"
            ],
            "Description": "** DISPUTED ** vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8991",
            "InstalledVersion": "7:2.02.185-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lvm2: memory leak in vg_lookup in daemons/lvmetad/lvmetad-core.c",
            "PkgName": "lvm2-libs",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8991",
              "https://sourceware.org/git/?p=lvm2.git;a=commit;h=bcf9556b8fcd16ad8997f80cc92785f295c66701"
            ],
            "Description": "** DISPUTED ** vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8991",
            "InstalledVersion": "7:2.02.185-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "lz4: heap-based buffer overflow in LZ4_write32",
            "PkgName": "lz4",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html",
              "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17543",
              "https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2",
              "https://github.com/lz4/lz4/issues/801",
              "https://github.com/lz4/lz4/pull/756",
              "https://github.com/lz4/lz4/pull/760",
              "https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17@%3Cissues.arrow.apache.org%3E",
              "https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6@%3Cissues.arrow.apache.org%3E",
              "https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357@%3Cissues.arrow.apache.org%3E",
              "https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3@%3Cissues.arrow.apache.org%3E",
              "https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316@%3Cissues.arrow.apache.org%3E",
              "https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3@%3Cdev.arrow.apache.org%3E",
              "https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26@%3Cissues.kudu.apache.org%3E",
              "https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720@%3Cissues.kudu.apache.org%3E",
              "https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960@%3Cissues.kudu.apache.org%3E"
            ],
            "Description": "LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17543",
            "InstalledVersion": "1.7.5-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c",
            "PkgName": "ncurses",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464687",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10684",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10684",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function",
            "PkgName": "ncurses",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464692",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10685",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10685",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 5.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c",
            "PkgName": "ncurses",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.html",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
            ],
            "Description": "There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17594",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5.8,
                "V3Score": 5.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c",
            "PkgName": "ncurses",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
            ],
            "Description": "There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17595",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in append_acs function",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464686",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11112",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11112",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference vulnerability in _nc_parse_entry function",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464691",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11113",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11113",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Infinite loop in the next_char function",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484274",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13728",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13728",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the _nc_save_str function",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13729",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13729",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function _nc_read_entry_source()",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484284",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13730",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13730",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function postprocess_termcap()",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484285",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13731",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13731",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function dump_uses()",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484287",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13732",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13732",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function fmt_entry",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484290",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13733",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13733",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function _nc_safe_strcat",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484291",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13734",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13734",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 2.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow in the _nc_write_entry function",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "http://invisible-island.net/ncurses/NEWS.html#t20171125",
              "http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16879",
              "https://security.gentoo.org/glsa/201804-13",
              "https://tools.cisco.com/security/center/viewAlert.x?alertId=57695"
            ],
            "Description": "Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16879",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference at function _nc_parse_entry in parse_entry.c",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1643754",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19211"
            ],
            "Description": "In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19211",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference at function _nc_name_match",
            "PkgName": "ncurses",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1643753",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19217"
            ],
            "Description": "** DISPUTED ** In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19217",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c",
            "PkgName": "ncurses-base",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464687",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10684",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10684",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function",
            "PkgName": "ncurses-base",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464692",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10685",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10685",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 5.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c",
            "PkgName": "ncurses-base",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.html",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
            ],
            "Description": "There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17594",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5.8,
                "V3Score": 5.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c",
            "PkgName": "ncurses-base",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
            ],
            "Description": "There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17595",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in append_acs function",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464686",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11112",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11112",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference vulnerability in _nc_parse_entry function",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464691",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11113",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11113",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Infinite loop in the next_char function",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484274",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13728",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13728",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the _nc_save_str function",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13729",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13729",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function _nc_read_entry_source()",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484284",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13730",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13730",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function postprocess_termcap()",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484285",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13731",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13731",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function dump_uses()",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484287",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13732",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13732",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function fmt_entry",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484290",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13733",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13733",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function _nc_safe_strcat",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484291",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13734",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13734",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 2.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow in the _nc_write_entry function",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "http://invisible-island.net/ncurses/NEWS.html#t20171125",
              "http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16879",
              "https://security.gentoo.org/glsa/201804-13",
              "https://tools.cisco.com/security/center/viewAlert.x?alertId=57695"
            ],
            "Description": "Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16879",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference at function _nc_parse_entry in parse_entry.c",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1643754",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19211"
            ],
            "Description": "In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19211",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference at function _nc_name_match",
            "PkgName": "ncurses-base",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1643753",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19217"
            ],
            "Description": "** DISPUTED ** In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19217",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c",
            "PkgName": "ncurses-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464687",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10684",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10684",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function",
            "PkgName": "ncurses-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464692",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10685",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10685",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 5.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c",
            "PkgName": "ncurses-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.html",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
            ],
            "Description": "There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17594",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5.8,
                "V3Score": 5.4,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 5.4,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c",
            "PkgName": "ncurses-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html",
              "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
            ],
            "Description": "There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17595",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in append_acs function",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464686",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11112",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11112",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference vulnerability in _nc_parse_entry function",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1464691",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11113",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11113",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Infinite loop in the next_char function",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484274",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13728",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13728",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the _nc_save_str function",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13729",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13729",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function _nc_read_entry_source()",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484284",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13730",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13730",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function postprocess_termcap()",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484285",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13731",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function postprocess_termcap() in parse_entry.c in ncurses 6.0 that will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13731",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function dump_uses()",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484287",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13732",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13732",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function fmt_entry",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484290",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13733",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13733",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Illegal address access in the function _nc_safe_strcat",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1484291",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13734",
              "https://security.gentoo.org/glsa/201804-13"
            ],
            "Description": "There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13734",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 2.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Stack-based buffer overflow in the _nc_write_entry function",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "http://invisible-island.net/ncurses/NEWS.html#t20171125",
              "http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16879",
              "https://security.gentoo.org/glsa/201804-13",
              "https://tools.cisco.com/security/center/viewAlert.x?alertId=57695"
            ],
            "Description": "Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-16879",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference at function _nc_parse_entry in parse_entry.c",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1643754",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19211"
            ],
            "Description": "In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19211",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "ncurses: Null pointer dereference at function _nc_name_match",
            "PkgName": "ncurses-libs",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1643753",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19217"
            ],
            "Description": "** DISPUTED ** In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-19217",
            "InstalledVersion": "5.9-14.20130511.el7_4"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 8.6,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nspr: Memory allocation issue related to PR_*printf functions",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/92385",
              "http://www.securitytracker.com/id/1036590",
              "http://www.ubuntu.com/usn/USN-3023-1",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1174015",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1951",
              "https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/dV4MyMsg6jw",
              "https://groups.google.com/forum/message/raw?msg=mozilla.dev.tech.nspr/dV4MyMsg6jw/hhWcXOgJDQAJ",
              "https://hg.mozilla.org/projects/nspr/rev/96381e3aaae2",
              "https://usn.ubuntu.com/usn/usn-3023-1",
              "https://usn.ubuntu.com/usn/usn-3028-1"
            ],
            "Description": "Multiple integer overflows in io/prprf.c in Mozilla Netscape Portable Runtime (NSPR) before 4.12 allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long string to a PR_*printf function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1951",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nspr",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nspr",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nspr",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "4.25.0-2.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "4.21.0-1.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
            "PkgName": "nss",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11745.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2020:0243",
              "https://access.redhat.com/errata/RHSA-2020:0466",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202003-02",
              "https://security.gentoo.org/glsa/202003-10",
              "https://security.gentoo.org/glsa/202003-37",
              "https://usn.ubuntu.com/4241-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4203-1",
              "https://usn.ubuntu.com/usn/usn-4203-2",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://usn.ubuntu.com/usn/usn-4241-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            ],
            "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.",
            "FixedVersion": "3.44.0-7.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11745",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: \"Invariance Weakness\" vulnerability in RC4 stream cipher",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://linux.oracle.com/cve/CVE-2015-2808.html",
              "http://linux.oracle.com/errata/ELSA-2015-1526.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html",
              "http://marc.info/?l=bugtraq&m=143456209711959&w=2",
              "http://marc.info/?l=bugtraq&m=143629696317098&w=2",
              "http://marc.info/?l=bugtraq&m=143741441012338&w=2",
              "http://marc.info/?l=bugtraq&m=143817021313142&w=2",
              "http://marc.info/?l=bugtraq&m=143817899717054&w=2",
              "http://marc.info/?l=bugtraq&m=143818140118771&w=2",
              "http://marc.info/?l=bugtraq&m=144043644216842&w=2",
              "http://marc.info/?l=bugtraq&m=144059660127919&w=2",
              "http://marc.info/?l=bugtraq&m=144059703728085&w=2",
              "http://marc.info/?l=bugtraq&m=144060576831314&w=2",
              "http://marc.info/?l=bugtraq&m=144060606031437&w=2",
              "http://marc.info/?l=bugtraq&m=144069189622016&w=2",
              "http://marc.info/?l=bugtraq&m=144102017024820&w=2",
              "http://marc.info/?l=bugtraq&m=144104533800819&w=2",
              "http://marc.info/?l=bugtraq&m=144104565600964&w=2",
              "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
              "http://rhn.redhat.com/errata/RHSA-2015-1006.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1007.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1020.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1021.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1091.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1228.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1229.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1230.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1243.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1526.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21883640",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21903565",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960015",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960769",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.huawei.com/en/psirt/security-advisories/hw-454055",
              "http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.securityfocus.com/bid/73684",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1032599",
              "http://www.securitytracker.com/id/1032600",
              "http://www.securitytracker.com/id/1032707",
              "http://www.securitytracker.com/id/1032708",
              "http://www.securitytracker.com/id/1032734",
              "http://www.securitytracker.com/id/1032788",
              "http://www.securitytracker.com/id/1032858",
              "http://www.securitytracker.com/id/1032868",
              "http://www.securitytracker.com/id/1032910",
              "http://www.securitytracker.com/id/1032990",
              "http://www.securitytracker.com/id/1033071",
              "http://www.securitytracker.com/id/1033072",
              "http://www.securitytracker.com/id/1033386",
              "http://www.securitytracker.com/id/1033415",
              "http://www.securitytracker.com/id/1033431",
              "http://www.securitytracker.com/id/1033432",
              "http://www.securitytracker.com/id/1033737",
              "http://www.securitytracker.com/id/1033769",
              "http://www.securitytracker.com/id/1036222",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808",
              "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888",
              "https://kb.juniper.net/JSA10783",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10163",
              "https://security.gentoo.org/glsa/201512-10",
              "https://usn.ubuntu.com/usn/usn-2696-1",
              "https://usn.ubuntu.com/usn/usn-2706-1",
              "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709",
              "https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf"
            ],
            "Description": "The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2808",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/5d2bb853ae31",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
              "http://linux.oracle.com/cve/CVE-2016-2183.html",
              "http://linux.oracle.com/errata/ELSA-2018-2123.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0462.html",
              "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21991482",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
              "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
              "http://www.securityfocus.com/bid/92630",
              "http://www.securityfocus.com/bid/95568",
              "http://www.securitytracker.com/id/1036696",
              "http://www.splunk.com/view/SP-CAAAPSV",
              "http://www.splunk.com/view/SP-CAAAPUE",
              "https://access.redhat.com/articles/2548661",
              "https://access.redhat.com/errata/RHSA-2016:1940",
              "https://access.redhat.com/errata/RHSA-2017:1216",
              "https://access.redhat.com/errata/RHSA-2017:2708",
              "https://access.redhat.com/errata/RHSA-2017:2709",
              "https://access.redhat.com/errata/RHSA-2017:2710",
              "https://access.redhat.com/errata/RHSA-2017:3113",
              "https://access.redhat.com/errata/RHSA-2017:3114",
              "https://access.redhat.com/errata/RHSA-2017:3239",
              "https://access.redhat.com/errata/RHSA-2017:3240",
              "https://access.redhat.com/errata/RHSA-2018:2123",
              "https://access.redhat.com/errata/RHSA-2019:1245",
              "https://access.redhat.com/errata/RHSA-2019:2859",
              "https://access.redhat.com/errata/RHSA-2020:0451",
              "https://access.redhat.com/security/cve/cve-2016-2183",
              "https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/",
              "https://bto.bluecoat.com/security-advisory/sa133",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1369383",
              "https://community.qualys.com/thread/16555",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183",
              "https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849",
              "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02",
              "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10310",
              "https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/",
              "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb05575",
              "https://security-tracker.debian.org/tracker/CVE-2016-2183",
              "https://security.gentoo.org/glsa/201612-16",
              "https://security.gentoo.org/glsa/201701-65",
              "https://security.gentoo.org/glsa/201707-01",
              "https://security.netapp.com/advisory/ntap-20160915-0001/",
              "https://security.netapp.com/advisory/ntap-20170119-0001/",
              "https://sweet32.info/",
              "https://twitter.com/symantec/status/768786631159603200",
              "https://usn.ubuntu.com/usn/usn-3087-1",
              "https://usn.ubuntu.com/usn/usn-3179-1",
              "https://usn.ubuntu.com/usn/usn-3194-1",
              "https://usn.ubuntu.com/usn/usn-3198-1",
              "https://usn.ubuntu.com/usn/usn-3270-1",
              "https://usn.ubuntu.com/usn/usn-3372-1",
              "https://www.ietf.org/mail-archive/web/tls/current/msg04560.html",
              "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008",
              "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/",
              "https://www.openssl.org/blog/blog/2016/08/24/sweet32/",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "https://www.sigsac.org/ccs/CCS2016/accepted-papers/",
              "https://www.suse.com/security/cve/CVE-2016-2183.html",
              "https://www.tenable.com/security/tns-2016-16",
              "https://www.tenable.com/security/tns-2016-20",
              "https://www.tenable.com/security/tns-2016-21",
              "https://www.tenable.com/security/tns-2017-09",
              "https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue"
            ],
            "Description": "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2183",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Insufficient timing side-channel resistance in divSpoiler",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/94341",
              "http://www.securitytracker.com/id/1037298",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1293334",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9074",
              "https://security.gentoo.org/glsa/201701-15",
              "https://security.gentoo.org/glsa/201701-46",
              "https://usn.ubuntu.com/usn/usn-3163-1",
              "https://www.debian.org/security/2016/dsa-3730",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/#CVE-2016-9074",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/",
              "https://www.mozilla.org/security/advisories/mfsa2016-89/",
              "https://www.mozilla.org/security/advisories/mfsa2016-90/",
              "https://www.mozilla.org/security/advisories/mfsa2016-93/"
            ],
            "Description": "An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9074",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1320695",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9574",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9574"
            ],
            "Description": "nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9574",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: NULL pointer dereference in several CMS functions resulting in a denial of service",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-18508.html",
              "http://linux.oracle.com/errata/ELSA-2019-1951.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18508",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.42.1_release_notes",
              "https://usn.ubuntu.com/usn/usn-3898-1",
              "https://usn.ubuntu.com/usn/usn-3898-2"
            ],
            "Description": "No description is available for this CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18508",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11729.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://access.redhat.com/errata/RHSA-2019:4190",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.44.0-7.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11729",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Timing attack on DSA signature generation",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631576",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.4_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.52.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202007-49",
              "https://usn.ubuntu.com/4421-1/",
              "https://usn.ubuntu.com/usn/usn-4383-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://usn.ubuntu.com/usn/usn-4397-2",
              "https://usn.ubuntu.com/usn/usn-4421-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/#CVE-2020-12399",
              "https://www.mozilla.org/security/advisories/mfsa2020-20/",
              "https://www.mozilla.org/security/advisories/mfsa2020-21/",
              "https://www.mozilla.org/security/advisories/mfsa2020-22/"
            ],
            "Description": "NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12399",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nss",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nss",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nss",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Information exposure when DH secret are reused across multiple TLS connections",
            "PkgName": "nss",
            "Severity": "LOW",
            "References": [
              "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E) by Robert Merget, Marcus Brinkmann, et al.",
              "Thorough Explanation can be found: https://raccoon-attack.com/RacoonAttack.pdf"
            ],
            "Description": "A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12413",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
            "PkgName": "nss-softokn",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11745.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2020:0243",
              "https://access.redhat.com/errata/RHSA-2020:0466",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202003-02",
              "https://security.gentoo.org/glsa/202003-10",
              "https://security.gentoo.org/glsa/202003-37",
              "https://usn.ubuntu.com/4241-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4203-1",
              "https://usn.ubuntu.com/usn/usn-4203-2",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://usn.ubuntu.com/usn/usn-4241-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            ],
            "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.",
            "FixedVersion": "3.44.0-8.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11745",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "NSS / JCE: missing EC parameter validation in ECDH_Derive() (OpenJDK JCE, 8075833)",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1485.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1488.html",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA",
              "http://www.securityfocus.com/bid/75871",
              "http://www.securitytracker.com/id/1032910",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2613",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10139",
              "https://security.gentoo.org/glsa/201603-11",
              "https://security.gentoo.org/glsa/201603-14",
              "https://usn.ubuntu.com/usn/usn-2696-1"
            ],
            "Description": "Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2613",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Mozilla: Elliptic curve point addition error when using mixed Jacobian-affine coordinates (MFSA 2017-18)",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/100383",
              "http://www.securitytracker.com/id/1039124",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1352039",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7781",
              "https://usn.ubuntu.com/usn/usn-3391-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7781",
              "https://www.mozilla.org/security/advisories/mfsa2017-18/"
            ],
            "Description": "An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result \"POINT_AT_INFINITY\" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7781",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11729.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://access.redhat.com/errata/RHSA-2019:4190",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.44.0-8.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11729",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nss-softokn",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Mozilla NSS: Errors in mp_div and mp_exptmod cryptographic functions",
            "PkgName": "nss-softokn",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html",
              "http://www.debian.org/security/2016/dsa-3688",
              "http://www.mozilla.org/security/announce/2016/mfsa2016-07.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.securityfocus.com/bid/81955",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1034825",
              "http://www.ubuntu.com/usn/USN-2880-1",
              "http://www.ubuntu.com/usn/USN-2880-2",
              "http://www.ubuntu.com/usn/USN-2903-1",
              "http://www.ubuntu.com/usn/USN-2903-2",
              "http://www.ubuntu.com/usn/USN-2973-1",
              "https://blog.fuzzing-project.org/37-Mozilla-NSS-Wrong-calculation-results-in-mp_div-and-mp_exptmod.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1190248",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1194947",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1938",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes",
              "https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_div.c",
              "https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_exptmod.c",
              "https://hg.mozilla.org/projects/nss/diff/a555bf0fc23a/lib/freebl/mpi/mpi.c",
              "https://security.gentoo.org/glsa/201605-06",
              "https://security.gentoo.org/glsa/201701-46",
              "https://usn.ubuntu.com/usn/usn-2880-1",
              "https://usn.ubuntu.com/usn/usn-2903-1",
              "https://usn.ubuntu.com/usn/usn-2973-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/"
            ],
            "Description": "The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1938",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nss-softokn",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nss-softokn",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
            "PkgName": "nss-softokn-freebl",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11745.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2020:0243",
              "https://access.redhat.com/errata/RHSA-2020:0466",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202003-02",
              "https://security.gentoo.org/glsa/202003-10",
              "https://security.gentoo.org/glsa/202003-37",
              "https://usn.ubuntu.com/4241-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4203-1",
              "https://usn.ubuntu.com/usn/usn-4203-2",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://usn.ubuntu.com/usn/usn-4241-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            ],
            "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.",
            "FixedVersion": "3.44.0-8.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11745",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "NSS / JCE: missing EC parameter validation in ECDH_Derive() (OpenJDK JCE, 8075833)",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1485.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1488.html",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA",
              "http://www.securityfocus.com/bid/75871",
              "http://www.securitytracker.com/id/1032910",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2613",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10139",
              "https://security.gentoo.org/glsa/201603-11",
              "https://security.gentoo.org/glsa/201603-14",
              "https://usn.ubuntu.com/usn/usn-2696-1"
            ],
            "Description": "Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2613",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Mozilla: Elliptic curve point addition error when using mixed Jacobian-affine coordinates (MFSA 2017-18)",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/100383",
              "http://www.securitytracker.com/id/1039124",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1352039",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7781",
              "https://usn.ubuntu.com/usn/usn-3391-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7781",
              "https://www.mozilla.org/security/advisories/mfsa2017-18/"
            ],
            "Description": "An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result \"POINT_AT_INFINITY\" when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. This vulnerability affects Firefox < 55.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7781",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11729.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://access.redhat.com/errata/RHSA-2019:4190",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.44.0-8.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11729",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nss-softokn-freebl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Mozilla NSS: Errors in mp_div and mp_exptmod cryptographic functions",
            "PkgName": "nss-softokn-freebl",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00002.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00010.html",
              "http://www.debian.org/security/2016/dsa-3688",
              "http://www.mozilla.org/security/announce/2016/mfsa2016-07.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.securityfocus.com/bid/81955",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1034825",
              "http://www.ubuntu.com/usn/USN-2880-1",
              "http://www.ubuntu.com/usn/USN-2880-2",
              "http://www.ubuntu.com/usn/USN-2903-1",
              "http://www.ubuntu.com/usn/USN-2903-2",
              "http://www.ubuntu.com/usn/USN-2973-1",
              "https://blog.fuzzing-project.org/37-Mozilla-NSS-Wrong-calculation-results-in-mp_div-and-mp_exptmod.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1190248",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1194947",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1938",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes",
              "https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_div.c",
              "https://github.com/hannob/bignum-fuzz/blob/master/CVE-2016-1938-nss-mp_exptmod.c",
              "https://hg.mozilla.org/projects/nss/diff/a555bf0fc23a/lib/freebl/mpi/mpi.c",
              "https://security.gentoo.org/glsa/201605-06",
              "https://security.gentoo.org/glsa/201701-46",
              "https://usn.ubuntu.com/usn/usn-2880-1",
              "https://usn.ubuntu.com/usn/usn-2903-1",
              "https://usn.ubuntu.com/usn/usn-2973-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/"
            ],
            "Description": "The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the (1) mp_div or (2) mp_exptmod function.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1938",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nss-softokn-freebl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nss-softokn-freebl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "3.53.1-6.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "3.44.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
            "PkgName": "nss-sysinit",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11745.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2020:0243",
              "https://access.redhat.com/errata/RHSA-2020:0466",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202003-02",
              "https://security.gentoo.org/glsa/202003-10",
              "https://security.gentoo.org/glsa/202003-37",
              "https://usn.ubuntu.com/4241-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4203-1",
              "https://usn.ubuntu.com/usn/usn-4203-2",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://usn.ubuntu.com/usn/usn-4241-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            ],
            "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.",
            "FixedVersion": "3.44.0-7.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11745",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: \"Invariance Weakness\" vulnerability in RC4 stream cipher",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://linux.oracle.com/cve/CVE-2015-2808.html",
              "http://linux.oracle.com/errata/ELSA-2015-1526.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html",
              "http://marc.info/?l=bugtraq&m=143456209711959&w=2",
              "http://marc.info/?l=bugtraq&m=143629696317098&w=2",
              "http://marc.info/?l=bugtraq&m=143741441012338&w=2",
              "http://marc.info/?l=bugtraq&m=143817021313142&w=2",
              "http://marc.info/?l=bugtraq&m=143817899717054&w=2",
              "http://marc.info/?l=bugtraq&m=143818140118771&w=2",
              "http://marc.info/?l=bugtraq&m=144043644216842&w=2",
              "http://marc.info/?l=bugtraq&m=144059660127919&w=2",
              "http://marc.info/?l=bugtraq&m=144059703728085&w=2",
              "http://marc.info/?l=bugtraq&m=144060576831314&w=2",
              "http://marc.info/?l=bugtraq&m=144060606031437&w=2",
              "http://marc.info/?l=bugtraq&m=144069189622016&w=2",
              "http://marc.info/?l=bugtraq&m=144102017024820&w=2",
              "http://marc.info/?l=bugtraq&m=144104533800819&w=2",
              "http://marc.info/?l=bugtraq&m=144104565600964&w=2",
              "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
              "http://rhn.redhat.com/errata/RHSA-2015-1006.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1007.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1020.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1021.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1091.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1228.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1229.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1230.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1243.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1526.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21883640",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21903565",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960015",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960769",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.huawei.com/en/psirt/security-advisories/hw-454055",
              "http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.securityfocus.com/bid/73684",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1032599",
              "http://www.securitytracker.com/id/1032600",
              "http://www.securitytracker.com/id/1032707",
              "http://www.securitytracker.com/id/1032708",
              "http://www.securitytracker.com/id/1032734",
              "http://www.securitytracker.com/id/1032788",
              "http://www.securitytracker.com/id/1032858",
              "http://www.securitytracker.com/id/1032868",
              "http://www.securitytracker.com/id/1032910",
              "http://www.securitytracker.com/id/1032990",
              "http://www.securitytracker.com/id/1033071",
              "http://www.securitytracker.com/id/1033072",
              "http://www.securitytracker.com/id/1033386",
              "http://www.securitytracker.com/id/1033415",
              "http://www.securitytracker.com/id/1033431",
              "http://www.securitytracker.com/id/1033432",
              "http://www.securitytracker.com/id/1033737",
              "http://www.securitytracker.com/id/1033769",
              "http://www.securitytracker.com/id/1036222",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808",
              "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888",
              "https://kb.juniper.net/JSA10783",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10163",
              "https://security.gentoo.org/glsa/201512-10",
              "https://usn.ubuntu.com/usn/usn-2696-1",
              "https://usn.ubuntu.com/usn/usn-2706-1",
              "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709",
              "https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf"
            ],
            "Description": "The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2808",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/5d2bb853ae31",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
              "http://linux.oracle.com/cve/CVE-2016-2183.html",
              "http://linux.oracle.com/errata/ELSA-2018-2123.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0462.html",
              "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21991482",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
              "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
              "http://www.securityfocus.com/bid/92630",
              "http://www.securityfocus.com/bid/95568",
              "http://www.securitytracker.com/id/1036696",
              "http://www.splunk.com/view/SP-CAAAPSV",
              "http://www.splunk.com/view/SP-CAAAPUE",
              "https://access.redhat.com/articles/2548661",
              "https://access.redhat.com/errata/RHSA-2016:1940",
              "https://access.redhat.com/errata/RHSA-2017:1216",
              "https://access.redhat.com/errata/RHSA-2017:2708",
              "https://access.redhat.com/errata/RHSA-2017:2709",
              "https://access.redhat.com/errata/RHSA-2017:2710",
              "https://access.redhat.com/errata/RHSA-2017:3113",
              "https://access.redhat.com/errata/RHSA-2017:3114",
              "https://access.redhat.com/errata/RHSA-2017:3239",
              "https://access.redhat.com/errata/RHSA-2017:3240",
              "https://access.redhat.com/errata/RHSA-2018:2123",
              "https://access.redhat.com/errata/RHSA-2019:1245",
              "https://access.redhat.com/errata/RHSA-2019:2859",
              "https://access.redhat.com/errata/RHSA-2020:0451",
              "https://access.redhat.com/security/cve/cve-2016-2183",
              "https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/",
              "https://bto.bluecoat.com/security-advisory/sa133",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1369383",
              "https://community.qualys.com/thread/16555",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183",
              "https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849",
              "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02",
              "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10310",
              "https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/",
              "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb05575",
              "https://security-tracker.debian.org/tracker/CVE-2016-2183",
              "https://security.gentoo.org/glsa/201612-16",
              "https://security.gentoo.org/glsa/201701-65",
              "https://security.gentoo.org/glsa/201707-01",
              "https://security.netapp.com/advisory/ntap-20160915-0001/",
              "https://security.netapp.com/advisory/ntap-20170119-0001/",
              "https://sweet32.info/",
              "https://twitter.com/symantec/status/768786631159603200",
              "https://usn.ubuntu.com/usn/usn-3087-1",
              "https://usn.ubuntu.com/usn/usn-3179-1",
              "https://usn.ubuntu.com/usn/usn-3194-1",
              "https://usn.ubuntu.com/usn/usn-3198-1",
              "https://usn.ubuntu.com/usn/usn-3270-1",
              "https://usn.ubuntu.com/usn/usn-3372-1",
              "https://www.ietf.org/mail-archive/web/tls/current/msg04560.html",
              "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008",
              "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/",
              "https://www.openssl.org/blog/blog/2016/08/24/sweet32/",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "https://www.sigsac.org/ccs/CCS2016/accepted-papers/",
              "https://www.suse.com/security/cve/CVE-2016-2183.html",
              "https://www.tenable.com/security/tns-2016-16",
              "https://www.tenable.com/security/tns-2016-20",
              "https://www.tenable.com/security/tns-2016-21",
              "https://www.tenable.com/security/tns-2017-09",
              "https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue"
            ],
            "Description": "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2183",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Insufficient timing side-channel resistance in divSpoiler",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/94341",
              "http://www.securitytracker.com/id/1037298",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1293334",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9074",
              "https://security.gentoo.org/glsa/201701-15",
              "https://security.gentoo.org/glsa/201701-46",
              "https://usn.ubuntu.com/usn/usn-3163-1",
              "https://www.debian.org/security/2016/dsa-3730",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/#CVE-2016-9074",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/",
              "https://www.mozilla.org/security/advisories/mfsa2016-89/",
              "https://www.mozilla.org/security/advisories/mfsa2016-90/",
              "https://www.mozilla.org/security/advisories/mfsa2016-93/"
            ],
            "Description": "An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9074",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1320695",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9574",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9574"
            ],
            "Description": "nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9574",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: NULL pointer dereference in several CMS functions resulting in a denial of service",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-18508.html",
              "http://linux.oracle.com/errata/ELSA-2019-1951.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18508",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.42.1_release_notes",
              "https://usn.ubuntu.com/usn/usn-3898-1",
              "https://usn.ubuntu.com/usn/usn-3898-2"
            ],
            "Description": "No description is available for this CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18508",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11729.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://access.redhat.com/errata/RHSA-2019:4190",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.44.0-7.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11729",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Timing attack on DSA signature generation",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631576",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.4_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.52.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202007-49",
              "https://usn.ubuntu.com/4421-1/",
              "https://usn.ubuntu.com/usn/usn-4383-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://usn.ubuntu.com/usn/usn-4397-2",
              "https://usn.ubuntu.com/usn/usn-4421-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/#CVE-2020-12399",
              "https://www.mozilla.org/security/advisories/mfsa2020-20/",
              "https://www.mozilla.org/security/advisories/mfsa2020-21/",
              "https://www.mozilla.org/security/advisories/mfsa2020-22/"
            ],
            "Description": "NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12399",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nss-sysinit",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nss-sysinit",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nss-sysinit",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Information exposure when DH secret are reused across multiple TLS connections",
            "PkgName": "nss-sysinit",
            "Severity": "LOW",
            "References": [
              "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E) by Robert Merget, Marcus Brinkmann, et al.",
              "Thorough Explanation can be found: https://raccoon-attack.com/RacoonAttack.pdf"
            ],
            "Description": "A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12413",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
            "PkgName": "nss-tools",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11745.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2020:0243",
              "https://access.redhat.com/errata/RHSA-2020:0466",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202003-02",
              "https://security.gentoo.org/glsa/202003-10",
              "https://security.gentoo.org/glsa/202003-37",
              "https://usn.ubuntu.com/4241-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4203-1",
              "https://usn.ubuntu.com/usn/usn-4203-2",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://usn.ubuntu.com/usn/usn-4241-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            ],
            "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.",
            "FixedVersion": "3.44.0-7.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11745",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: \"Invariance Weakness\" vulnerability in RC4 stream cipher",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://linux.oracle.com/cve/CVE-2015-2808.html",
              "http://linux.oracle.com/errata/ELSA-2015-1526.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html",
              "http://marc.info/?l=bugtraq&m=143456209711959&w=2",
              "http://marc.info/?l=bugtraq&m=143629696317098&w=2",
              "http://marc.info/?l=bugtraq&m=143741441012338&w=2",
              "http://marc.info/?l=bugtraq&m=143817021313142&w=2",
              "http://marc.info/?l=bugtraq&m=143817899717054&w=2",
              "http://marc.info/?l=bugtraq&m=143818140118771&w=2",
              "http://marc.info/?l=bugtraq&m=144043644216842&w=2",
              "http://marc.info/?l=bugtraq&m=144059660127919&w=2",
              "http://marc.info/?l=bugtraq&m=144059703728085&w=2",
              "http://marc.info/?l=bugtraq&m=144060576831314&w=2",
              "http://marc.info/?l=bugtraq&m=144060606031437&w=2",
              "http://marc.info/?l=bugtraq&m=144069189622016&w=2",
              "http://marc.info/?l=bugtraq&m=144102017024820&w=2",
              "http://marc.info/?l=bugtraq&m=144104533800819&w=2",
              "http://marc.info/?l=bugtraq&m=144104565600964&w=2",
              "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
              "http://rhn.redhat.com/errata/RHSA-2015-1006.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1007.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1020.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1021.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1091.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1228.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1229.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1230.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1243.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1526.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21883640",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21903565",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960015",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960769",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.huawei.com/en/psirt/security-advisories/hw-454055",
              "http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.securityfocus.com/bid/73684",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1032599",
              "http://www.securitytracker.com/id/1032600",
              "http://www.securitytracker.com/id/1032707",
              "http://www.securitytracker.com/id/1032708",
              "http://www.securitytracker.com/id/1032734",
              "http://www.securitytracker.com/id/1032788",
              "http://www.securitytracker.com/id/1032858",
              "http://www.securitytracker.com/id/1032868",
              "http://www.securitytracker.com/id/1032910",
              "http://www.securitytracker.com/id/1032990",
              "http://www.securitytracker.com/id/1033071",
              "http://www.securitytracker.com/id/1033072",
              "http://www.securitytracker.com/id/1033386",
              "http://www.securitytracker.com/id/1033415",
              "http://www.securitytracker.com/id/1033431",
              "http://www.securitytracker.com/id/1033432",
              "http://www.securitytracker.com/id/1033737",
              "http://www.securitytracker.com/id/1033769",
              "http://www.securitytracker.com/id/1036222",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808",
              "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888",
              "https://kb.juniper.net/JSA10783",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10163",
              "https://security.gentoo.org/glsa/201512-10",
              "https://usn.ubuntu.com/usn/usn-2696-1",
              "https://usn.ubuntu.com/usn/usn-2706-1",
              "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709",
              "https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf"
            ],
            "Description": "The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2808",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/5d2bb853ae31",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759",
              "http://linux.oracle.com/cve/CVE-2016-2183.html",
              "http://linux.oracle.com/errata/ELSA-2018-2123.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0336.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0337.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0338.html",
              "http://rhn.redhat.com/errata/RHSA-2017-0462.html",
              "http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21991482",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21995039",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html",
              "http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html",
              "http://www.securityfocus.com/bid/92630",
              "http://www.securityfocus.com/bid/95568",
              "http://www.securitytracker.com/id/1036696",
              "http://www.splunk.com/view/SP-CAAAPSV",
              "http://www.splunk.com/view/SP-CAAAPUE",
              "https://access.redhat.com/articles/2548661",
              "https://access.redhat.com/errata/RHSA-2016:1940",
              "https://access.redhat.com/errata/RHSA-2017:1216",
              "https://access.redhat.com/errata/RHSA-2017:2708",
              "https://access.redhat.com/errata/RHSA-2017:2709",
              "https://access.redhat.com/errata/RHSA-2017:2710",
              "https://access.redhat.com/errata/RHSA-2017:3113",
              "https://access.redhat.com/errata/RHSA-2017:3114",
              "https://access.redhat.com/errata/RHSA-2017:3239",
              "https://access.redhat.com/errata/RHSA-2017:3240",
              "https://access.redhat.com/errata/RHSA-2018:2123",
              "https://access.redhat.com/errata/RHSA-2019:1245",
              "https://access.redhat.com/errata/RHSA-2019:2859",
              "https://access.redhat.com/errata/RHSA-2020:0451",
              "https://access.redhat.com/security/cve/cve-2016-2183",
              "https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/",
              "https://bto.bluecoat.com/security-advisory/sa133",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1369383",
              "https://community.qualys.com/thread/16555",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2183",
              "https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849",
              "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02",
              "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10171",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10310",
              "https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/",
              "https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb05575",
              "https://security-tracker.debian.org/tracker/CVE-2016-2183",
              "https://security.gentoo.org/glsa/201612-16",
              "https://security.gentoo.org/glsa/201701-65",
              "https://security.gentoo.org/glsa/201707-01",
              "https://security.netapp.com/advisory/ntap-20160915-0001/",
              "https://security.netapp.com/advisory/ntap-20170119-0001/",
              "https://sweet32.info/",
              "https://twitter.com/symantec/status/768786631159603200",
              "https://usn.ubuntu.com/usn/usn-3087-1",
              "https://usn.ubuntu.com/usn/usn-3179-1",
              "https://usn.ubuntu.com/usn/usn-3194-1",
              "https://usn.ubuntu.com/usn/usn-3198-1",
              "https://usn.ubuntu.com/usn/usn-3270-1",
              "https://usn.ubuntu.com/usn/usn-3372-1",
              "https://www.ietf.org/mail-archive/web/tls/current/msg04560.html",
              "https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008",
              "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/",
              "https://www.openssl.org/blog/blog/2016/08/24/sweet32/",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
              "https://www.sigsac.org/ccs/CCS2016/accepted-papers/",
              "https://www.suse.com/security/cve/CVE-2016-2183.html",
              "https://www.tenable.com/security/tns-2016-16",
              "https://www.tenable.com/security/tns-2016-20",
              "https://www.tenable.com/security/tns-2016-21",
              "https://www.tenable.com/security/tns-2017-09",
              "https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue"
            ],
            "Description": "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2183",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Insufficient timing side-channel resistance in divSpoiler",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/94341",
              "http://www.securitytracker.com/id/1037298",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1293334",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9074",
              "https://security.gentoo.org/glsa/201701-15",
              "https://security.gentoo.org/glsa/201701-46",
              "https://usn.ubuntu.com/usn/usn-3163-1",
              "https://www.debian.org/security/2016/dsa-3730",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/#CVE-2016-9074",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/",
              "https://www.mozilla.org/security/advisories/mfsa2016-89/",
              "https://www.mozilla.org/security/advisories/mfsa2016-90/",
              "https://www.mozilla.org/security/advisories/mfsa2016-93/"
            ],
            "Description": "An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9074",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1320695",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9574",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9574"
            ],
            "Description": "nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9574",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: NULL pointer dereference in several CMS functions resulting in a denial of service",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-18508.html",
              "http://linux.oracle.com/errata/ELSA-2019-1951.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18508",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.42.1_release_notes",
              "https://usn.ubuntu.com/usn/usn-3898-1",
              "https://usn.ubuntu.com/usn/usn-3898-2"
            ],
            "Description": "No description is available for this CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18508",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11729.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://access.redhat.com/errata/RHSA-2019:4190",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.44.0-7.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11729",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Timing attack on DSA signature generation",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631576",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12399",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.4_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.52.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202007-49",
              "https://usn.ubuntu.com/4421-1/",
              "https://usn.ubuntu.com/usn/usn-4383-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://usn.ubuntu.com/usn/usn-4397-2",
              "https://usn.ubuntu.com/usn/usn-4421-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/#CVE-2020-12399",
              "https://www.mozilla.org/security/advisories/mfsa2020-20/",
              "https://www.mozilla.org/security/advisories/mfsa2020-21/",
              "https://www.mozilla.org/security/advisories/mfsa2020-22/"
            ],
            "Description": "NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12399",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nss-tools",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nss-tools",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nss-tools",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "3.53.1-3.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Information exposure when DH secret are reused across multiple TLS connections",
            "PkgName": "nss-tools",
            "Severity": "LOW",
            "References": [
              "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E) by Robert Merget, Marcus Brinkmann, et al.",
              "Thorough Explanation can be found: https://raccoon-attack.com/RacoonAttack.pdf"
            ],
            "Description": "A flaw was found in Mozilla nss. A raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The highest threat from this vulnerability is to data confidentiality.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12413",
            "InstalledVersion": "3.44.0-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
            "PkgName": "nss-util",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11745.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2020:0243",
              "https://access.redhat.com/errata/RHSA-2020:0466",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/202003-02",
              "https://security.gentoo.org/glsa/202003-10",
              "https://security.gentoo.org/glsa/202003-37",
              "https://usn.ubuntu.com/4241-1/",
              "https://usn.ubuntu.com/4335-1/",
              "https://usn.ubuntu.com/usn/usn-4203-1",
              "https://usn.ubuntu.com/usn/usn-4203-2",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://usn.ubuntu.com/usn/usn-4241-1",
              "https://usn.ubuntu.com/usn/usn-4335-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            ],
            "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.",
            "FixedVersion": "3.44.0-4.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11745",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Out-of-bounds read when importing curve25519 private key",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11719.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1540541",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11719",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11719",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11729.html",
              "http://linux.oracle.com/errata/ELSA-2019-4190.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://access.redhat.com/errata/RHSA-2019:4190",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://security.gentoo.org/glsa/201908-12",
              "https://security.gentoo.org/glsa/201908-20",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://usn.ubuntu.com/usn/usn-4060-2",
              "https://usn.ubuntu.com/usn/usn-4064-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/",
              "https://www.mozilla.org/security/advisories/mfsa2019-22/",
              "https://www.mozilla.org/security/advisories/mfsa2019-23/"
            ],
            "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.",
            "FixedVersion": "3.44.0-4.el7_7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11729",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Use-after-free in sftk_FreeSession due to improper refcounting",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11756.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1508776",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11756",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes",
              "https://usn.ubuntu.com/usn/usn-4216-1",
              "https://usn.ubuntu.com/usn/usn-4216-2",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756",
              "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            ],
            "Description": "Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11756",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Check length of inputs for cryptographic primitives",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17006.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17006",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes",
              "https://hg.mozilla.org/projects/nss/rev/9d1f5e71773d4e3146524096d74cb96c8df51abe",
              "https://hg.mozilla.org/projects/nss/rev/dfd6996fe7425eb0437346d11a01082f16fcfe34",
              "https://usn.ubuntu.com/usn/usn-4231-1"
            ],
            "Description": "A vulnerability was discovered in nss where input text length was not checked when using certain cryptographic primitives. This could lead to a heap-buffer overflow resulting in a crash and data leak. The highest threat is to confidentiality and integrity of data as well as system availability.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17006",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12400.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1623116",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12400",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12400",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: ECDSA timing attack mitigation bypass",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12401.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631573",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-12401",
              "https://www.mozilla.org/security/advisories/mfsa2020-36/",
              "https://www.mozilla.org/security/advisories/mfsa2020-39/"
            ],
            "Description": "During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12401",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.2,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel vulnerabilities during RSA key generation",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12402.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1631597",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12402",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53.1_release_notes",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RFL6UNFK4MG2WDXLMLFAEIUSM5EUK7CG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UWVDJRARXNWWWTCGMM63EXLQHH2LNOXO/",
              "https://security.gentoo.org/glsa/202007-10",
              "https://usn.ubuntu.com/4417-1/",
              "https://usn.ubuntu.com/4417-2/",
              "https://usn.ubuntu.com/usn/usn-4417-1",
              "https://usn.ubuntu.com/usn/usn-4417-2",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/security/advisories/mfsa2020-24/"
            ],
            "Description": "During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12402",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12403.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://access.redhat.com/security/cve/CVE-2020-12403",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4476-1"
            ],
            "Description": "A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12403",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: Side channel attack on ECDSA signature generation",
            "PkgName": "nss-util",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-6829.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes",
              "https://usn.ubuntu.com/usn/usn-4455-1",
              "https://usn.ubuntu.com/usn/usn-4474-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-6829"
            ],
            "Description": "A flaw was found in nss. Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-6829",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 3.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: PKCS#1 v1.5 signatures can be used for TLS 1.3",
            "PkgName": "nss-util",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11727.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
              "https://access.redhat.com/errata/RHSA-2019:1951",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1552208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11727",
              "https://security.gentoo.org/glsa/201908-12",
              "https://usn.ubuntu.com/usn/usn-4054-1",
              "https://usn.ubuntu.com/usn/usn-4060-1",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727",
              "https://www.mozilla.org/security/advisories/mfsa2019-21/"
            ],
            "Description": "A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11727",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state",
            "PkgName": "nss-util",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17023.html",
              "http://linux.oracle.com/errata/ELSA-2020-4076.html",
              "https://bugzilla.mozilla.org/show_bug.cgi?id=1590001",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17023",
              "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes",
              "https://usn.ubuntu.com/4234-1/",
              "https://usn.ubuntu.com/4397-1/",
              "https://usn.ubuntu.com/usn/usn-4234-1",
              "https://usn.ubuntu.com/usn/usn-4397-1",
              "https://www.debian.org/security/2020/dsa-4726",
              "https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17023",
              "https://www.mozilla.org/security/advisories/mfsa2020-01/"
            ],
            "Description": "After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. This vulnerability affects Firefox < 72.",
            "FixedVersion": "3.53.1-1.el7_9",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17023",
            "InstalledVersion": "3.44.0-3.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution",
            "PkgName": "numpy",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-6446.html",
              "http://linux.oracle.com/errata/ELSA-2019-3704.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00092.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00015.html",
              "http://www.securityfocus.com/bid/106670",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3704",
              "https://bugzilla.suse.com/show_bug.cgi?id=1122208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6446",
              "https://github.com/numpy/numpy/issues/12759",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE4/"
            ],
            "Description": "** DISPUTED **   An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is  a behavior that might have legitimate applications in (for example)  loading serialized Python object arrays from trusted and authenticated  sources.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-6446",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "CVE-2014-1859 numpy: f2py insecure temporary file use",
            "PkgName": "numpy",
            "Severity": "LOW",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html",
              "http://www.openwall.com/lists/oss-security/2014/02/08/3",
              "http://www.securityfocus.com/bid/65441",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1062009",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1858",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/91318",
              "https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst",
              "https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15",
              "https://github.com/numpy/numpy/pull/4262"
            ],
            "Description": "__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-1858",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "CVE-2014-1858 CVE-2014-1859 numpy: f2py insecure temporary file use",
            "PkgName": "numpy",
            "Severity": "LOW",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html",
              "http://www.openwall.com/lists/oss-security/2014/02/08/3",
              "http://www.securityfocus.com/bid/65440",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1062009",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1859",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/91317",
              "https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst",
              "https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15",
              "https://github.com/numpy/numpy/pull/4262"
            ],
            "Description": "(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-1859",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "numpy: Missing input validation on empty list or ndarray in numpy.pad function",
            "PkgName": "numpy",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12852",
              "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852",
              "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"
            ],
            "Description": "The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12852",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "numpy: crafted serialized object passed in numpy.load() in pickle python module allows arbitrary code execution",
            "PkgName": "numpy-f2py",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-6446.html",
              "http://linux.oracle.com/errata/ELSA-2019-3704.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00091.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00092.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00015.html",
              "http://www.securityfocus.com/bid/106670",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3704",
              "https://bugzilla.suse.com/show_bug.cgi?id=1122208",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6446",
              "https://github.com/numpy/numpy/issues/12759",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZZAYIQNUUYXGMKHSPEEXS4TRYFOUYE4/"
            ],
            "Description": "** DISPUTED **   An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is  a behavior that might have legitimate applications in (for example)  loading serialized Python object arrays from trusted and authenticated  sources.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-6446",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "CVE-2014-1859 numpy: f2py insecure temporary file use",
            "PkgName": "numpy-f2py",
            "Severity": "LOW",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html",
              "http://www.openwall.com/lists/oss-security/2014/02/08/3",
              "http://www.securityfocus.com/bid/65441",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1062009",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1858",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/91318",
              "https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst",
              "https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15",
              "https://github.com/numpy/numpy/pull/4262"
            ],
            "Description": "__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-1858",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "CVE-2014-1858 CVE-2014-1859 numpy: f2py insecure temporary file use",
            "PkgName": "numpy-f2py",
            "Severity": "LOW",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128358.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128781.html",
              "http://www.openwall.com/lists/oss-security/2014/02/08/3",
              "http://www.securityfocus.com/bid/65440",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737778",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1062009",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1859",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/91317",
              "https://github.com/numpy/numpy/blob/maintenance/1.8.x/doc/release/1.8.1-notes.rst",
              "https://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15",
              "https://github.com/numpy/numpy/pull/4262"
            ],
            "Description": "(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-1859",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "numpy: Missing input validation on empty list or ndarray in numpy.pad function",
            "PkgName": "numpy-f2py",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12852",
              "https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852",
              "https://github.com/numpy/numpy/issues/9560#issuecomment-322395292"
            ],
            "Description": "The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-12852",
            "InstalledVersion": "1:1.7.1-13.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.5,
                "V3Score": 4.9,
                "V2Vector": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "openldap: Information disclosure issue in slapd component",
            "PkgName": "openldap",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html",
              "http://seclists.org/fulldisclosure/2019/Dec/26",
              "http://www.openldap.org/lists/openldap-announce/201907/msg00001.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13057",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html",
              "https://openldap.org/its/?findid=9038",
              "https://seclists.org/bugtraq/2019/Dec/23",
              "https://security.netapp.com/advisory/ntap-20190822-0004/",
              "https://support.apple.com/kb/HT210788",
              "https://usn.ubuntu.com/4078-1/",
              "https://usn.ubuntu.com/4078-2/",
              "https://usn.ubuntu.com/usn/usn-4078-1",
              "https://usn.ubuntu.com/usn/usn-4078-2",
              "https://www.openldap.org/its/?findid=9038",
              "https://www.openldap.org/lists/openldap-announce/201907/msg00001.html",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13057",
            "InstalledVersion": "2.4.44-21.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.4,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "openldap: ACL restrictions bypass due to sasl_ssf value being set permanently",
            "PkgName": "openldap",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html",
              "http://seclists.org/fulldisclosure/2019/Dec/26",
              "http://www.openldap.org/lists/openldap-announce/201907/msg00001.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13565",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html",
              "https://openldap.org/its/?findid=9052",
              "https://seclists.org/bugtraq/2019/Dec/23",
              "https://support.apple.com/kb/HT210788",
              "https://support.f5.com/csp/article/K98008862?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4078-1/",
              "https://usn.ubuntu.com/4078-2/",
              "https://usn.ubuntu.com/usn/usn-4078-1",
              "https://usn.ubuntu.com/usn/usn-4078-2",
              "https://www.openldap.org/its/index.cgi/?findid=9052",
              "https://www.openldap.org/lists/openldap-announce/201907/msg00001.html",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13565",
            "InstalledVersion": "2.4.44-21.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "openldap: denial of service via nested boolean expressions in LDAP search filters",
            "PkgName": "openldap",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-12243.html",
              "http://linux.oracle.com/errata/ELSA-2020-4041.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html",
              "https://bugs.openldap.org/show_bug.cgi?id=9202",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12243",
              "https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES",
              "https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440",
              "https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html",
              "https://lists.openldap.org/hyperkitty/list/openldap-announce@openldap.org/thread/FUOYA6YCHBXMLANBJMSO22JD2NB22WGC/",
              "https://security.netapp.com/advisory/ntap-20200511-0003/",
              "https://support.apple.com/kb/HT211289",
              "https://usn.ubuntu.com/4352-1/",
              "https://usn.ubuntu.com/4352-2/",
              "https://usn.ubuntu.com/usn/usn-4352-1",
              "https://usn.ubuntu.com/usn/usn-4352-2",
              "https://www.debian.org/security/2020/dsa-4666"
            ],
            "Description": "In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).",
            "FixedVersion": "2.4.44-22.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12243",
            "InstalledVersion": "2.4.44-21.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.9,
                "V3Score": 2.7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "openldap-servers: /usr/libexec/openldap/generate-server-cert.sh create world readable password file",
            "PkgName": "openldap",
            "Severity": "LOW",
            "References": ["https://bugzilla.redhat.com/show_bug.cgi?id=1346120"],
            "Description": "/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-4984",
            "InstalledVersion": "2.4.44-21.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4,
                "V3Score": 4.2,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 4.2,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "openldap: Certificate validation incorrectly matches name against CN-ID",
            "PkgName": "openldap",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html",
              "https://access.redhat.com/errata/RHBA-2019:3674",
              "https://bugs.openldap.org/show_bug.cgi?id=9266",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1740070"
            ],
            "Description": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-15719",
            "InstalledVersion": "2.4.44-21.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: \"Invariance Weakness\" vulnerability in RC4 stream cipher",
            "PkgName": "openssl",
            "Severity": "MEDIUM",
            "References": [
              "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://linux.oracle.com/cve/CVE-2015-2808.html",
              "http://linux.oracle.com/errata/ELSA-2015-1526.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html",
              "http://marc.info/?l=bugtraq&m=143456209711959&w=2",
              "http://marc.info/?l=bugtraq&m=143629696317098&w=2",
              "http://marc.info/?l=bugtraq&m=143741441012338&w=2",
              "http://marc.info/?l=bugtraq&m=143817021313142&w=2",
              "http://marc.info/?l=bugtraq&m=143817899717054&w=2",
              "http://marc.info/?l=bugtraq&m=143818140118771&w=2",
              "http://marc.info/?l=bugtraq&m=144043644216842&w=2",
              "http://marc.info/?l=bugtraq&m=144059660127919&w=2",
              "http://marc.info/?l=bugtraq&m=144059703728085&w=2",
              "http://marc.info/?l=bugtraq&m=144060576831314&w=2",
              "http://marc.info/?l=bugtraq&m=144060606031437&w=2",
              "http://marc.info/?l=bugtraq&m=144069189622016&w=2",
              "http://marc.info/?l=bugtraq&m=144102017024820&w=2",
              "http://marc.info/?l=bugtraq&m=144104533800819&w=2",
              "http://marc.info/?l=bugtraq&m=144104565600964&w=2",
              "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
              "http://rhn.redhat.com/errata/RHSA-2015-1006.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1007.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1020.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1021.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1091.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1228.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1229.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1230.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1243.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1526.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21883640",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21903565",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960015",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960769",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.huawei.com/en/psirt/security-advisories/hw-454055",
              "http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.securityfocus.com/bid/73684",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1032599",
              "http://www.securitytracker.com/id/1032600",
              "http://www.securitytracker.com/id/1032707",
              "http://www.securitytracker.com/id/1032708",
              "http://www.securitytracker.com/id/1032734",
              "http://www.securitytracker.com/id/1032788",
              "http://www.securitytracker.com/id/1032858",
              "http://www.securitytracker.com/id/1032868",
              "http://www.securitytracker.com/id/1032910",
              "http://www.securitytracker.com/id/1032990",
              "http://www.securitytracker.com/id/1033071",
              "http://www.securitytracker.com/id/1033072",
              "http://www.securitytracker.com/id/1033386",
              "http://www.securitytracker.com/id/1033415",
              "http://www.securitytracker.com/id/1033431",
              "http://www.securitytracker.com/id/1033432",
              "http://www.securitytracker.com/id/1033737",
              "http://www.securitytracker.com/id/1033769",
              "http://www.securitytracker.com/id/1036222",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808",
              "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888",
              "https://kb.juniper.net/JSA10783",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10163",
              "https://security.gentoo.org/glsa/201512-10",
              "https://usn.ubuntu.com/usn/usn-2696-1",
              "https://usn.ubuntu.com/usn/usn-2706-1",
              "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709",
              "https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf"
            ],
            "Description": "The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2808",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: side-channel weak encryption vulnerability",
            "PkgName": "openssl",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-1547.html",
              "http://linux.oracle.com/errata/ELSA-2020-1840.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
              "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
              "https://arxiv.org/abs/1909.01785",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
              "https://seclists.org/bugtraq/2019/Oct/0",
              "https://seclists.org/bugtraq/2019/Oct/1",
              "https://seclists.org/bugtraq/2019/Sep/25",
              "https://security.gentoo.org/glsa/201911-04",
              "https://security.netapp.com/advisory/ntap-20190919-0002/",
              "https://security.netapp.com/advisory/ntap-20200122-0002/",
              "https://security.netapp.com/advisory/ntap-20200416-0003/",
              "https://support.f5.com/csp/article/K73422160?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4376-1/",
              "https://usn.ubuntu.com/4376-2/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4376-1",
              "https://usn.ubuntu.com/usn/usn-4376-2",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.debian.org/security/2019/dsa-4539",
              "https://www.debian.org/security/2019/dsa-4540",
              "https://www.openssl.org/news/secadv/20190910.txt",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "https://www.tenable.com/security/tns-2019-08",
              "https://www.tenable.com/security/tns-2019-09"
            ],
            "Description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1547",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.1,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: timing side channel attack in the ECDSA signature generation",
            "PkgName": "openssl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-0735.html",
              "http://linux.oracle.com/errata/ELSA-2019-3700.html",
              "http://www.securityfocus.com/bid/105750",
              "http://www.securitytracker.com/id/1041986",
              "https://access.redhat.com/errata/RHSA-2019:3700",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0735",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=56fb454d281a023b3f950d969693553d3f3ceea1",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html",
              "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
              "https://security.netapp.com/advisory/ntap-20181105-0002/",
              "https://usn.ubuntu.com/3840-1/",
              "https://usn.ubuntu.com/usn/usn-3840-1",
              "https://www.debian.org/security/2018/dsa-4348",
              "https://www.openssl.org/news/secadv/20181029.txt",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            ],
            "Description": "The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-0735",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: Integer overflow in RSAZ modular exponentiation on x86_64",
            "PkgName": "openssl",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
              "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
              "https://github.com/openssl/openssl/pull/10575",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/",
              "https://seclists.org/bugtraq/2019/Dec/39",
              "https://seclists.org/bugtraq/2019/Dec/46",
              "https://security.gentoo.org/glsa/202004-10",
              "https://security.netapp.com/advisory/ntap-20191210-0001/",
              "https://usn.ubuntu.com/4376-1/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4376-1",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.debian.org/security/2019/dsa-4594",
              "https://www.openssl.org/news/secadv/20191206.txt",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.tenable.com/security/tns-2019-09",
              "https://www.tenable.com/security/tns-2020-03"
            ],
            "Description": "There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1551",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey",
            "PkgName": "openssl",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-1563.html",
              "http://linux.oracle.com/errata/ELSA-2020-1840.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
              "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
              "https://seclists.org/bugtraq/2019/Oct/0",
              "https://seclists.org/bugtraq/2019/Oct/1",
              "https://seclists.org/bugtraq/2019/Sep/25",
              "https://security.gentoo.org/glsa/201911-04",
              "https://security.netapp.com/advisory/ntap-20190919-0002/",
              "https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4376-1/",
              "https://usn.ubuntu.com/4376-2/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4376-1",
              "https://usn.ubuntu.com/usn/usn-4376-2",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.debian.org/security/2019/dsa-4539",
              "https://www.debian.org/security/2019/dsa-4540",
              "https://www.openssl.org/news/secadv/20190910.txt",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "https://www.tenable.com/security/tns-2019-09"
            ],
            "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1563",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: Information exposure when DH secret are reused across multiple TLS connections",
            "PkgName": "openssl",
            "Severity": "LOW",
            "References": [
              "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E) by Robert Merget, Marcus Brinkmann, et al.",
              "Thorough Explanation can be found: https://raccoon-attack.com/RacoonAttack.pdf",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1968",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html",
              "https://security.netapp.com/advisory/ntap-20200911-0004/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.openssl.org/news/secadv/20200909.txt"
            ],
            "Description": "The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1968",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "SSL/TLS: \"Invariance Weakness\" vulnerability in RC4 stream cipher",
            "PkgName": "openssl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705",
              "http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727",
              "http://linux.oracle.com/cve/CVE-2015-2808.html",
              "http://linux.oracle.com/errata/ELSA-2015-1526.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html",
              "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html",
              "http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html",
              "http://marc.info/?l=bugtraq&m=143456209711959&w=2",
              "http://marc.info/?l=bugtraq&m=143629696317098&w=2",
              "http://marc.info/?l=bugtraq&m=143741441012338&w=2",
              "http://marc.info/?l=bugtraq&m=143817021313142&w=2",
              "http://marc.info/?l=bugtraq&m=143817899717054&w=2",
              "http://marc.info/?l=bugtraq&m=143818140118771&w=2",
              "http://marc.info/?l=bugtraq&m=144043644216842&w=2",
              "http://marc.info/?l=bugtraq&m=144059660127919&w=2",
              "http://marc.info/?l=bugtraq&m=144059703728085&w=2",
              "http://marc.info/?l=bugtraq&m=144060576831314&w=2",
              "http://marc.info/?l=bugtraq&m=144060606031437&w=2",
              "http://marc.info/?l=bugtraq&m=144069189622016&w=2",
              "http://marc.info/?l=bugtraq&m=144102017024820&w=2",
              "http://marc.info/?l=bugtraq&m=144104533800819&w=2",
              "http://marc.info/?l=bugtraq&m=144104565600964&w=2",
              "http://marc.info/?l=bugtraq&m=144493176821532&w=2",
              "http://rhn.redhat.com/errata/RHSA-2015-1006.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1007.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1020.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1021.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1091.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1228.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1229.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1230.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1241.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1242.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1243.html",
              "http://rhn.redhat.com/errata/RHSA-2015-1526.html",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888",
              "http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892",
              "http://www-01.ibm.com/support/docview.wss?uid=swg21883640",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21903565",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960015",
              "http://www-304.ibm.com/support/docview.wss?uid=swg21960769",
              "http://www.debian.org/security/2015/dsa-3316",
              "http://www.debian.org/security/2015/dsa-3339",
              "http://www.huawei.com/en/psirt/security-advisories/hw-454055",
              "http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf",
              "http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "http://www.securityfocus.com/bid/73684",
              "http://www.securityfocus.com/bid/91787",
              "http://www.securitytracker.com/id/1032599",
              "http://www.securitytracker.com/id/1032600",
              "http://www.securitytracker.com/id/1032707",
              "http://www.securitytracker.com/id/1032708",
              "http://www.securitytracker.com/id/1032734",
              "http://www.securitytracker.com/id/1032788",
              "http://www.securitytracker.com/id/1032858",
              "http://www.securitytracker.com/id/1032868",
              "http://www.securitytracker.com/id/1032910",
              "http://www.securitytracker.com/id/1032990",
              "http://www.securitytracker.com/id/1033071",
              "http://www.securitytracker.com/id/1033072",
              "http://www.securitytracker.com/id/1033386",
              "http://www.securitytracker.com/id/1033415",
              "http://www.securitytracker.com/id/1033431",
              "http://www.securitytracker.com/id/1033432",
              "http://www.securitytracker.com/id/1033737",
              "http://www.securitytracker.com/id/1033769",
              "http://www.securitytracker.com/id/1036222",
              "http://www.ubuntu.com/usn/USN-2696-1",
              "http://www.ubuntu.com/usn/USN-2706-1",
              "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2808",
              "https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246",
              "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650",
              "https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888",
              "https://kb.juniper.net/JSA10783",
              "https://kc.mcafee.com/corporate/index?page=content&id=SB10163",
              "https://security.gentoo.org/glsa/201512-10",
              "https://usn.ubuntu.com/usn/usn-2696-1",
              "https://usn.ubuntu.com/usn/usn-2706-1",
              "https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709",
              "https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf"
            ],
            "Description": "The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the \"Bar Mitzvah\" issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-2808",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: side-channel weak encryption vulnerability",
            "PkgName": "openssl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-1547.html",
              "http://linux.oracle.com/errata/ELSA-2020-1840.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
              "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
              "https://arxiv.org/abs/1909.01785",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
              "https://seclists.org/bugtraq/2019/Oct/0",
              "https://seclists.org/bugtraq/2019/Oct/1",
              "https://seclists.org/bugtraq/2019/Sep/25",
              "https://security.gentoo.org/glsa/201911-04",
              "https://security.netapp.com/advisory/ntap-20190919-0002/",
              "https://security.netapp.com/advisory/ntap-20200122-0002/",
              "https://security.netapp.com/advisory/ntap-20200416-0003/",
              "https://support.f5.com/csp/article/K73422160?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4376-1/",
              "https://usn.ubuntu.com/4376-2/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4376-1",
              "https://usn.ubuntu.com/usn/usn-4376-2",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.debian.org/security/2019/dsa-4539",
              "https://www.debian.org/security/2019/dsa-4540",
              "https://www.openssl.org/news/secadv/20190910.txt",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "https://www.tenable.com/security/tns-2019-08",
              "https://www.tenable.com/security/tns-2019-09"
            ],
            "Description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1547",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.1,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: timing side channel attack in the ECDSA signature generation",
            "PkgName": "openssl-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-0735.html",
              "http://linux.oracle.com/errata/ELSA-2019-3700.html",
              "http://www.securityfocus.com/bid/105750",
              "http://www.securitytracker.com/id/1041986",
              "https://access.redhat.com/errata/RHSA-2019:3700",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0735",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=56fb454d281a023b3f950d969693553d3f3ceea1",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html",
              "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
              "https://security.netapp.com/advisory/ntap-20181105-0002/",
              "https://usn.ubuntu.com/3840-1/",
              "https://usn.ubuntu.com/usn/usn-3840-1",
              "https://www.debian.org/security/2018/dsa-4348",
              "https://www.openssl.org/news/secadv/20181029.txt",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
              "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
            ],
            "Description": "The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-0735",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: Integer overflow in RSAZ modular exponentiation on x86_64",
            "PkgName": "openssl-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
              "http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
              "https://github.com/openssl/openssl/pull/10575",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/",
              "https://seclists.org/bugtraq/2019/Dec/39",
              "https://seclists.org/bugtraq/2019/Dec/46",
              "https://security.gentoo.org/glsa/202004-10",
              "https://security.netapp.com/advisory/ntap-20191210-0001/",
              "https://usn.ubuntu.com/4376-1/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4376-1",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.debian.org/security/2019/dsa-4594",
              "https://www.openssl.org/news/secadv/20191206.txt",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.tenable.com/security/tns-2019-09",
              "https://www.tenable.com/security/tns-2020-03"
            ],
            "Description": "There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1551",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey",
            "PkgName": "openssl-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-1563.html",
              "http://linux.oracle.com/errata/ELSA-2020-1840.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
              "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
              "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
              "https://seclists.org/bugtraq/2019/Oct/0",
              "https://seclists.org/bugtraq/2019/Oct/1",
              "https://seclists.org/bugtraq/2019/Sep/25",
              "https://security.gentoo.org/glsa/201911-04",
              "https://security.netapp.com/advisory/ntap-20190919-0002/",
              "https://support.f5.com/csp/article/K97324400?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4376-1/",
              "https://usn.ubuntu.com/4376-2/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4376-1",
              "https://usn.ubuntu.com/usn/usn-4376-2",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.debian.org/security/2019/dsa-4539",
              "https://www.debian.org/security/2019/dsa-4540",
              "https://www.openssl.org/news/secadv/20190910.txt",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "https://www.tenable.com/security/tns-2019-09"
            ],
            "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-1563",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 3.7,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "openssl: Information exposure when DH secret are reused across multiple TLS connections",
            "PkgName": "openssl-libs",
            "Severity": "LOW",
            "References": [
              "Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles in TLS-DH(E) by Robert Merget, Marcus Brinkmann, et al.",
              "Thorough Explanation can be found: https://raccoon-attack.com/RacoonAttack.pdf",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1968",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html",
              "https://security.netapp.com/advisory/ntap-20200911-0004/",
              "https://usn.ubuntu.com/4504-1/",
              "https://usn.ubuntu.com/usn/usn-4504-1",
              "https://www.openssl.org/news/secadv/20200909.txt"
            ],
            "Description": "The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1968",
            "InstalledVersion": "1:1.0.2k-19.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: OOB write when pcre_exec() is called with ovecsize of 1 (8.38/10)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173700.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/77695",
              "https://blog.fuzzing-project.org/29-Heap-Overflow-in-PCRE.html",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://bugs.exim.org/show_bug.cgi?id=1637",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8380",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \\01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8380",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: Integer overflow in subroutine calls (8.38/8)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8387",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8387",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: uninitialized memory read triggered by malformed posix character class (8.38/22)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8390",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the [: and \\\\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8390",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: pcregrep -q is not always quiet (8.38/28)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8393",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8393",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: Integer overflow caused by missing check for certain conditions (8.38/31)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/82990",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8394",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201607-02",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8394",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: Out-of-bounds read in compile_bracket_matchingpath function (8.41/3)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/96295",
              "http://www.securitytracker.com/id/1037850",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://bugs.exim.org/show_bug.cgi?id=2035",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6004",
              "https://security.gentoo.org/glsa/201706-11",
              "https://vcs.pcre.org/pcre/code/trunk/pcre_jit_compile.c?r1=1676&r2=1680&view=patch"
            ],
            "Description": "The compile_bracket_matchingpath function in pcre_jit_compile.c in PCRE through 8.x before revision 1680 (e.g., the PHP 7.1.1 bundled version) allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6004",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: Invalid Unicode property lookup (8.41/7, 10.24/2)",
            "PkgName": "pcre",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/97030",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/",
              "https://bugs.exim.org/show_bug.cgi?id=2052",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7186",
              "https://security.gentoo.org/glsa/201710-09",
              "https://security.gentoo.org/glsa/201710-25",
              "https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date",
              "https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date",
              "https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=date",
              "https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=date"
            ],
            "Description": "libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7186",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"
              },
              "redhat": {
                "V2Score": 1.9,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "php: Regular Expression Uninitialized Pointer Information Disclosure Vulnerability (ZDI-CAN-2547)",
            "PkgName": "pcre",
            "Severity": "LOW",
            "References": [
              "http://git.php.net/?p=php-src.git;a=commit;h=c351b47ce85a3a147cfa801fa9f0149ab4160834",
              "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "http://vcs.pcre.org/pcre/code/trunk/pcre_exec.c?r1=1502&r2=1510",
              "http://www.openwall.com/lists/oss-security/2015/08/04/2",
              "http://www.openwall.com/lists/oss-security/2015/08/04/3",
              "http://www.openwall.com/lists/oss-security/2015/11/29/1",
              "http://www.securityfocus.com/bid/76157",
              "https://bto.bluecoat.com/security-advisory/sa128",
              "https://bugs.exim.org/show_bug.cgi?id=1537",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1187225",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8382",
              "https://usn.ubuntu.com/usn/usn-2943-1"
            ],
            "Description": "The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8382",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.8,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: OP_KETRMAX feature in the match function in pcre_exec.c",
            "PkgName": "pcre",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2017/07/11/3",
              "http://www.securityfocus.com/bid/99575",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164"
            ],
            "Description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11164",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: invalid memory read in _pcre32_xclass (pcre_xclass.c)",
            "PkgName": "pcre",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97067",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/20/libpcre-invalid-memory-read-in-_pcre32_xclass-pcre_xclass-c/",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7244",
              "https://security.gentoo.org/glsa/201710-25"
            ],
            "Description": "The _pcre32_xclass function in pcre_xclass.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (invalid memory read) via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7244",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: stack-based buffer overflow write in pcre32_copy_substring",
            "PkgName": "pcre",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97067",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/",
              "https://security.gentoo.org/glsa/201710-25"
            ],
            "Description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7245",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: stack-based buffer overflow write in pcre32_copy_substring",
            "PkgName": "pcre",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/97067",
              "https://access.redhat.com/errata/RHSA-2018:2486",
              "https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/",
              "https://security.gentoo.org/glsa/201710-25"
            ],
            "Description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7246",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "pcre: integer overflow in libpcre",
            "PkgName": "pcre",
            "Severity": "LOW",
            "References": [
              "https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/",
              "https://bugs.gentoo.org/717920",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155",
              "https://www.pcre.org/original/changelog.txt"
            ],
            "Description": "libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-14155",
            "InstalledVersion": "8.32-17.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.4,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: regexp matching hangs indefinitely on illegal UTF-8 input",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/7",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/86707",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1329106",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8853",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://rt.perl.org/Public/Bug/Display.html?id=123562",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by \"a\\x80.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8853",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: loading of modules from current directory",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://ledgersmbdev.blogspot.ca/2016/07/notes-on-security-separation-of.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html",
              "http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html",
              "http://www.securityfocus.com/bid/92136",
              "http://www.securitytracker.com/id/1036440",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1238",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/",
              "https://rt.perl.org/Public/Bug/Display.html?id=127834",
              "https://security.gentoo.org/glsa/201701-75",
              "https://security.gentoo.org/glsa/201812-07"
            ],
            "Description": "(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1238",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: ambiguous environment variables handling",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076",
              "http://www.debian.org/security/2016/dsa-3501",
              "http://www.gossamer-threads.com/lists/perl/porters/326387",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/83802",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2381",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/usn/usn-2916-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2381",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: XSLoader loads relative paths not included in @INC",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.openwall.com/lists/oss-security/2016/07/07/1",
              "http://www.openwall.com/lists/oss-security/2016/07/08/5",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/91685",
              "http://www.securitytracker.com/id/1036260",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6185",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/",
              "https://rt.cpan.org/Public/Bug/Display.html?id=115808",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6185",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 8.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.2,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: heap-based buffer overflow in regular expression compiler leads to DoS",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10543",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 8.6,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.6,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10878",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8",
              "https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10878",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS",
            "PkgName": "perl",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12723",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/Perl/perl5/issues/16947",
              "https://github.com/Perl/perl5/issues/17743",
              "https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12723",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: segmentation fault in S_regmatch on negative backreference",
            "PkgName": "perl",
            "Severity": "LOW",
            "References": [
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://perl5.git.perl.org/perl.git/commit/0c2990d652e985784f095bba4bc356481a66aa06",
              "http://www.securityfocus.com/bid/75704",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7422",
              "https://security.gentoo.org/glsa/201507-11",
              "https://support.apple.com/kb/HT205031",
              "https://usn.ubuntu.com/usn/usn-2916-1"
            ],
            "Description": "Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7422",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 4.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl-File-Path: rmtree/remove_tree race condition",
            "PkgName": "perl-File-Path",
            "Severity": "LOW",
            "References": [
              "http://cpansearch.perl.org/src/JKEENAN/File-Path-2.13/Changes",
              "http://security.cucumberlinux.com/security/details.php?id=153",
              "http://www.debian.org/security/2017/dsa-3873",
              "http://www.securityfocus.com/bid/99180",
              "http://www.securitytracker.com/id/1038610",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6512",
              "https://rt.cpan.org/Ticket/Display.html?id=121951",
              "https://security.gentoo.org/glsa/201709-12",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6512",
            "InstalledVersion": "2.09-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.4,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: regexp matching hangs indefinitely on illegal UTF-8 input",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/7",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/86707",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1329106",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8853",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://rt.perl.org/Public/Bug/Display.html?id=123562",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by \"a\\x80.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8853",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: loading of modules from current directory",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://ledgersmbdev.blogspot.ca/2016/07/notes-on-security-separation-of.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html",
              "http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html",
              "http://www.securityfocus.com/bid/92136",
              "http://www.securitytracker.com/id/1036440",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1238",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/",
              "https://rt.perl.org/Public/Bug/Display.html?id=127834",
              "https://security.gentoo.org/glsa/201701-75",
              "https://security.gentoo.org/glsa/201812-07"
            ],
            "Description": "(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1238",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: ambiguous environment variables handling",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076",
              "http://www.debian.org/security/2016/dsa-3501",
              "http://www.gossamer-threads.com/lists/perl/porters/326387",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/83802",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2381",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/usn/usn-2916-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2381",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: XSLoader loads relative paths not included in @INC",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.openwall.com/lists/oss-security/2016/07/07/1",
              "http://www.openwall.com/lists/oss-security/2016/07/08/5",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/91685",
              "http://www.securitytracker.com/id/1036260",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6185",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/",
              "https://rt.cpan.org/Public/Bug/Display.html?id=115808",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6185",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 8.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.2,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: heap-based buffer overflow in regular expression compiler leads to DoS",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10543",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 8.6,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.6,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10878",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8",
              "https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10878",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12723",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/Perl/perl5/issues/16947",
              "https://github.com/Perl/perl5/issues/17743",
              "https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12723",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: segmentation fault in S_regmatch on negative backreference",
            "PkgName": "perl-Pod-Escapes",
            "Severity": "LOW",
            "References": [
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://perl5.git.perl.org/perl.git/commit/0c2990d652e985784f095bba4bc356481a66aa06",
              "http://www.securityfocus.com/bid/75704",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7422",
              "https://security.gentoo.org/glsa/201507-11",
              "https://support.apple.com/kb/HT205031",
              "https://usn.ubuntu.com/usn/usn-2916-1"
            ],
            "Description": "Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7422",
            "InstalledVersion": "1:1.04-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.4,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: regexp matching hangs indefinitely on illegal UTF-8 input",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/7",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/86707",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1329106",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8853",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://rt.perl.org/Public/Bug/Display.html?id=123562",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by \"a\\x80.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8853",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: loading of modules from current directory",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://ledgersmbdev.blogspot.ca/2016/07/notes-on-security-separation-of.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html",
              "http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html",
              "http://www.securityfocus.com/bid/92136",
              "http://www.securitytracker.com/id/1036440",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1238",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/",
              "https://rt.perl.org/Public/Bug/Display.html?id=127834",
              "https://security.gentoo.org/glsa/201701-75",
              "https://security.gentoo.org/glsa/201812-07"
            ],
            "Description": "(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1238",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: ambiguous environment variables handling",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076",
              "http://www.debian.org/security/2016/dsa-3501",
              "http://www.gossamer-threads.com/lists/perl/porters/326387",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/83802",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2381",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/usn/usn-2916-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2381",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: XSLoader loads relative paths not included in @INC",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.openwall.com/lists/oss-security/2016/07/07/1",
              "http://www.openwall.com/lists/oss-security/2016/07/08/5",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/91685",
              "http://www.securitytracker.com/id/1036260",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6185",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/",
              "https://rt.cpan.org/Public/Bug/Display.html?id=115808",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6185",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 8.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.2,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: heap-based buffer overflow in regular expression compiler leads to DoS",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10543",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 8.6,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.6,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10878",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8",
              "https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10878",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS",
            "PkgName": "perl-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12723",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/Perl/perl5/issues/16947",
              "https://github.com/Perl/perl5/issues/17743",
              "https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12723",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: segmentation fault in S_regmatch on negative backreference",
            "PkgName": "perl-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://perl5.git.perl.org/perl.git/commit/0c2990d652e985784f095bba4bc356481a66aa06",
              "http://www.securityfocus.com/bid/75704",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7422",
              "https://security.gentoo.org/glsa/201507-11",
              "https://support.apple.com/kb/HT205031",
              "https://usn.ubuntu.com/usn/usn-2916-1"
            ],
            "Description": "Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7422",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 5.4,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: regexp matching hangs indefinitely on illegal UTF-8 input",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183592.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/5",
              "http://www.openwall.com/lists/oss-security/2016/04/20/7",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/86707",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1329106",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8853",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://rt.perl.org/Public/Bug/Display.html?id=123562",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by \"a\\x80.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8853",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: loading of modules from current directory",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://ledgersmbdev.blogspot.ca/2016/07/notes-on-security-separation-of.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html",
              "http://perl5.git.perl.org/perl.git/commit/cee96d52c39b1e7b36e1c62d38bcd8d86e9a41ab",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html",
              "http://www.securityfocus.com/bid/92136",
              "http://www.securitytracker.com/id/1036440",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1238",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FBQOCV3GBAN2EYZUM3CFDJ4ECA3GZOK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DOFRQWJRP2NQJEYEWOMECVW3HAMD5SYN/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TZBNQH3DMI7HDELJAZ4TFJJANHXOEDWH/",
              "https://rt.perl.org/Public/Bug/Display.html?id=127834",
              "https://security.gentoo.org/glsa/201701-75",
              "https://security.gentoo.org/glsa/201812-07"
            ],
            "Description": "(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-1238",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: ambiguous environment variables handling",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html",
              "http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076",
              "http://www.debian.org/security/2016/dsa-3501",
              "http://www.gossamer-threads.com/lists/perl/porters/326387",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/83802",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2381",
              "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/usn/usn-2916-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2381",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.8,
                "V3Score": 7.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: XSLoader loads relative paths not included in @INC",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://perl5.git.perl.org/perl.git/commitdiff/08e3451d7",
              "http://www.debian.org/security/2016/dsa-3628",
              "http://www.openwall.com/lists/oss-security/2016/07/07/1",
              "http://www.openwall.com/lists/oss-security/2016/07/08/5",
              "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html",
              "http://www.securityfocus.com/bid/91685",
              "http://www.securitytracker.com/id/1036260",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6185",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RFDMASVZLFZYBB2GNTZXU6I76E4NA4V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITYZJXQH24X2F2LAOQEQAC5KXLYJTJ76/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PRIPTDA6XINBVEJXI2NGLKVEINBREHTN/",
              "https://rt.cpan.org/Public/Bug/Display.html?id=115808",
              "https://security.gentoo.org/glsa/201701-75",
              "https://usn.ubuntu.com/3625-1/",
              "https://usn.ubuntu.com/3625-2/",
              "https://usn.ubuntu.com/usn/usn-3625-1",
              "https://usn.ubuntu.com/usn/usn-3625-2"
            ],
            "Description": "The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6185",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 8.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.2,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: heap-based buffer overflow in regular expression compiler leads to DoS",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10543",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 8.6,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              },
              "redhat": {
                "V3Score": 8.6,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to integer overflow leads to DoS",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10878",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8",
              "https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-10878",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: corruption of intermediate language state of compiled regular expression due to recursive S_study_chunk() calls leads to DoS",
            "PkgName": "perl-macros",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12723",
              "https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod",
              "https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3",
              "https://github.com/Perl/perl5/issues/16947",
              "https://github.com/Perl/perl5/issues/17743",
              "https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.28.3/pod/perldelta.pod",
              "https://metacpan.org/pod/release/XSAWYERX/perl-5.30.3/pod/perldelta.pod",
              "https://security.gentoo.org/glsa/202006-03",
              "https://security.netapp.com/advisory/ntap-20200611-0001/"
            ],
            "Description": "regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-12723",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "perl: segmentation fault in S_regmatch on negative backreference",
            "PkgName": "perl-macros",
            "Severity": "LOW",
            "References": [
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://perl5.git.perl.org/perl.git/commit/0c2990d652e985784f095bba4bc356481a66aa06",
              "http://www.securityfocus.com/bid/75704",
              "http://www.ubuntu.com/usn/USN-2916-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7422",
              "https://security.gentoo.org/glsa/201507-11",
              "https://support.apple.com/kb/HT205031",
              "https://usn.ubuntu.com/usn/usn-2916-1"
            ],
            "Description": "Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7422",
            "InstalledVersion": "4:5.16.3-294.el7_6"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 3.9,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "procps-ng, procps: process hiding through race condition enumerating /proc",
            "PkgName": "procps-ng",
            "Severity": "LOW",
            "References": [
              "http://seclists.org/oss-sec/2018/q2/122",
              "http://www.securityfocus.com/bid/104214",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1121",
              "https://www.exploit-db.com/exploits/44806/",
              "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            ],
            "Description": "procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1121",
            "InstalledVersion": "3.3.10-26.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.9,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "procps-ng, procps: denial of service in ps via mmap buffer overflow",
            "PkgName": "procps-ng",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html",
              "http://seclists.org/oss-sec/2018/q2/122",
              "http://www.securityfocus.com/bid/104214",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1123",
              "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html",
              "https://security.gentoo.org/glsa/201805-14",
              "https://usn.ubuntu.com/3658-1/",
              "https://usn.ubuntu.com/3658-3/",
              "https://usn.ubuntu.com/usn/usn-3658-1",
              "https://usn.ubuntu.com/usn/usn-3658-3",
              "https://www.debian.org/security/2018/dsa-4208",
              "https://www.exploit-db.com/exploits/44806/",
              "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            ],
            "Description": "procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1123",
            "InstalledVersion": "3.3.10-26.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 4.4,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "procps-ng, procps: stack buffer overflow in pgrep",
            "PkgName": "procps-ng",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html",
              "http://seclists.org/oss-sec/2018/q2/122",
              "http://www.securityfocus.com/bid/104214",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1125",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1125",
              "https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html",
              "https://usn.ubuntu.com/3658-1/",
              "https://usn.ubuntu.com/3658-3/",
              "https://usn.ubuntu.com/usn/usn-3658-1",
              "https://usn.ubuntu.com/usn/usn-3658-3",
              "https://www.debian.org/security/2018/dsa-4208",
              "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
            ],
            "Description": "procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1125",
            "InstalledVersion": "3.3.10-26.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pyOpenSSL: Use-after-free in X509 object handling",
            "PkgName": "pyOpenSSL",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html",
              "https://access.redhat.com/errata/RHSA-2019:0085",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000807",
              "https://github.com/advisories/GHSA-p28m-34f6-967q",
              "https://github.com/pyca/pyopenssl/pull/723",
              "https://nvd.nist.gov/vuln/detail/CVE-2018-1000807",
              "https://usn.ubuntu.com/3813-1/",
              "https://usn.ubuntu.com/usn/usn-3813-1"
            ],
            "Description": "Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1000807",
            "InstalledVersion": "0.13.1-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.7,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "pyOpenSSL: Failure to release memory before removing last reference in PKCS #12 Store",
            "PkgName": "pyOpenSSL",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00014.html",
              "https://access.redhat.com/errata/RHSA-2019:0085",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000808",
              "https://github.com/advisories/GHSA-2rcm-phc9-3945",
              "https://github.com/pyca/pyopenssl/pull/723",
              "https://nvd.nist.gov/vuln/detail/CVE-2018-1000808",
              "https://usn.ubuntu.com/3813-1/",
              "https://usn.ubuntu.com/usn/usn-3813-1"
            ],
            "Description": "Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1000808",
            "InstalledVersion": "0.13.1-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Python xml bindings: Internal entity expansion in Python XML libraries inflicts DoS vulnerabilities",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://blog.python.org/2013/02/announcing-defusedxms-fixes-for-xml.html",
              "http://bugs.python.org/issue17239",
              "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0657.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0658.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0670.html",
              "http://ubuntu.com/usn/usn-1757-1",
              "http://www.openwall.com/lists/oss-security/2013/02/19/2",
              "http://www.openwall.com/lists/oss-security/2013/02/19/4",
              "https://bugs.launchpad.net/nova/+bug/1100282",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1664",
              "https://usn.ubuntu.com/usn/usn-1730-1",
              "https://usn.ubuntu.com/usn/usn-1731-1",
              "https://usn.ubuntu.com/usn/usn-1734-1",
              "https://usn.ubuntu.com/usn/usn-1757-1",
              "https://www.djangoproject.com/weblog/2013/feb/19/security/"
            ],
            "Description": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-1664",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 5.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Python xml bindings: External entity expansion in Python XML libraries inflicts potential security flaws and DoS vulnerabilities",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://blog.python.org/2013/02/announcing-defusedxms-fixes-for-xml.html",
              "http://bugs.python.org/issue17239",
              "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0657.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0658.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0670.html",
              "http://ubuntu.com/usn/usn-1757-1",
              "http://www.debian.org/security/2013/dsa-2634",
              "http://www.openwall.com/lists/oss-security/2013/02/19/2",
              "http://www.openwall.com/lists/oss-security/2013/02/19/4",
              "https://bugs.launchpad.net/keystone/+bug/1100279",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1665",
              "https://usn.ubuntu.com/usn/usn-1730-1",
              "https://usn.ubuntu.com/usn/usn-1757-1",
              "https://www.djangoproject.com/weblog/2013/feb/19/security/"
            ],
            "Description": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-1665",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: hash secret can be recovered remotely",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://bugs.python.org/issue14621",
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://www.openwall.com/lists/oss-security/2013/12/09/13",
              "http://www.openwall.com/lists/oss-security/2013/12/09/3",
              "http://www.securityfocus.com/bid/64194",
              "https://support.apple.com/kb/HT205031"
            ],
            "Description": "Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7040",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Integer overflow in PyString_DecodeEscape results in heap-base buffer overflow",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://python-security.readthedocs.io/vuln/cve-2017-1000158_pystring_decodeescape_integer_overflow.html",
              "http://www.securitytracker.com/id/1039890",
              "https://bugs.python.org/issue30657",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000158",
              "https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
              "https://security.gentoo.org/glsa/201805-02",
              "https://usn.ubuntu.com/usn/usn-3496-1",
              "https://usn.ubuntu.com/usn/usn-3496-2",
              "https://usn.ubuntu.com/usn/usn-3496-3",
              "https://www.debian.org/security/2018/dsa-4307"
            ],
            "Description": "CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000158",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Cookie domain check returns incorrect results",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20852.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue35121",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
            "FixedVersion": "2.7.5-88.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20852",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: email.utils.parseaddr wrongly parses email addresses",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16056.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue34155",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
              "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20190926-0005/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
            "FixedVersion": "2.7.5-88.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16056",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16935.html",
              "http://linux.oracle.com/errata/ELSA-2020-3911.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://bugs.python.org/issue38243",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935",
              "https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897",
              "https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213",
              "https://github.com/python/cpython/pull/16373",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20191017-0004/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.",
            "FixedVersion": "2.7.5-89.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16935",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the host part of the url passed to urlopen()",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue30458#msg347282",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1727276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://security.netapp.com/advisory/ntap-20191107-0004/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18348",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: infinite loop in the tarfile module via crafted TAR archive",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html",
              "https://bugs.python.org/issue39017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907",
              "https://github.com/python/cpython/pull/21454",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200731-0002/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20907",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 7.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via HTTP request method in httplib/http.client",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.python.org/issue39603",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/",
              "https://python-security.readthedocs.io/vuln/http-header-injection-method.html"
            ],
            "Description": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-26116",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS",
            "PkgName": "python",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8492.html",
              "http://linux.oracle.com/errata/ELSA-2020-3888.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "https://bugs.python.org/issue39503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492",
              "https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4",
              "https://github.com/python/cpython/pull/18284",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html",
              "https://security.gentoo.org/glsa/202005-09",
              "https://security.netapp.com/advisory/ntap-20200221-0001/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8492",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.3,
                "V3Score": 3.6,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 3.6,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Heap-Buffer-Overflow and Heap-Use-After-Free in Objects/fileobject.c",
            "PkgName": "python",
            "Severity": "LOW",
            "References": [
              "https://bugs.python.org/issue31530",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000030",
              "https://drive.google.com/file/d/1oyR9DAZjZK_SCn3mor6NRAYLJS6ueXaY/view",
              "https://security.gentoo.org/glsa/201811-02",
              "https://usn.ubuntu.com/3817-1/",
              "https://usn.ubuntu.com/3817-2/",
              "https://usn.ubuntu.com/usn/usn-3817-1",
              "https://usn.ubuntu.com/usn/usn-3817-2",
              "https://www.dropbox.com/sh/sj3ee7xv55j36k7/AADwP-YfOYikBMuy32e0uvPFa?dl=0",
              "https://www.oracle.com/security-alerts/cpujan2020.html"
            ],
            "Description": "Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1000030",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Nested zip file (Zip bomb) vulnerability in Lib/zipfile.py",
            "PkgName": "python",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue36260",
              "https://bugs.python.org/issue36462",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9674",
              "https://github.com/python/cpython/blob/master/Lib/zipfile.py",
              "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb",
              "https://security.netapp.com/advisory/ntap-20200221-0003/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1",
              "https://www.python.org/news/security/"
            ],
            "Description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9674",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5.2,
                "V3Score": 6.8,
                "V2Vector": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.7,
                "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-beaker:  Deserialization of Untrusted Data which can lead to Arbitrary code execution",
            "PkgName": "python-beaker",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1850105",
              "https://github.com/bbangert/beaker/issues/191",
              "https://www.openwall.com/lists/oss-security/2020/05/14/11"
            ],
            "Description": "The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7489",
            "InstalledVersion": "1.5.4-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Python xml bindings: Internal entity expansion in Python XML libraries inflicts DoS vulnerabilities",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://blog.python.org/2013/02/announcing-defusedxms-fixes-for-xml.html",
              "http://bugs.python.org/issue17239",
              "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0657.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0658.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0670.html",
              "http://ubuntu.com/usn/usn-1757-1",
              "http://www.openwall.com/lists/oss-security/2013/02/19/2",
              "http://www.openwall.com/lists/oss-security/2013/02/19/4",
              "https://bugs.launchpad.net/nova/+bug/1100282",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1664",
              "https://usn.ubuntu.com/usn/usn-1730-1",
              "https://usn.ubuntu.com/usn/usn-1731-1",
              "https://usn.ubuntu.com/usn/usn-1734-1",
              "https://usn.ubuntu.com/usn/usn-1757-1",
              "https://www.djangoproject.com/weblog/2013/feb/19/security/"
            ],
            "Description": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-1664",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 5.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Python xml bindings: External entity expansion in Python XML libraries inflicts potential security flaws and DoS vulnerabilities",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://blog.python.org/2013/02/announcing-defusedxms-fixes-for-xml.html",
              "http://bugs.python.org/issue17239",
              "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0657.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0658.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0670.html",
              "http://ubuntu.com/usn/usn-1757-1",
              "http://www.debian.org/security/2013/dsa-2634",
              "http://www.openwall.com/lists/oss-security/2013/02/19/2",
              "http://www.openwall.com/lists/oss-security/2013/02/19/4",
              "https://bugs.launchpad.net/keystone/+bug/1100279",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1665",
              "https://usn.ubuntu.com/usn/usn-1730-1",
              "https://usn.ubuntu.com/usn/usn-1757-1",
              "https://www.djangoproject.com/weblog/2013/feb/19/security/"
            ],
            "Description": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-1665",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: hash secret can be recovered remotely",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://bugs.python.org/issue14621",
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://www.openwall.com/lists/oss-security/2013/12/09/13",
              "http://www.openwall.com/lists/oss-security/2013/12/09/3",
              "http://www.securityfocus.com/bid/64194",
              "https://support.apple.com/kb/HT205031"
            ],
            "Description": "Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7040",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Integer overflow in PyString_DecodeEscape results in heap-base buffer overflow",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://python-security.readthedocs.io/vuln/cve-2017-1000158_pystring_decodeescape_integer_overflow.html",
              "http://www.securitytracker.com/id/1039890",
              "https://bugs.python.org/issue30657",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000158",
              "https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
              "https://security.gentoo.org/glsa/201805-02",
              "https://usn.ubuntu.com/usn/usn-3496-1",
              "https://usn.ubuntu.com/usn/usn-3496-2",
              "https://usn.ubuntu.com/usn/usn-3496-3",
              "https://www.debian.org/security/2018/dsa-4307"
            ],
            "Description": "CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000158",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Cookie domain check returns incorrect results",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20852.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue35121",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
            "FixedVersion": "2.7.5-88.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20852",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: email.utils.parseaddr wrongly parses email addresses",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16056.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue34155",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
              "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20190926-0005/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
            "FixedVersion": "2.7.5-88.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16056",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16935.html",
              "http://linux.oracle.com/errata/ELSA-2020-3911.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://bugs.python.org/issue38243",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935",
              "https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897",
              "https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213",
              "https://github.com/python/cpython/pull/16373",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20191017-0004/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.",
            "FixedVersion": "2.7.5-89.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16935",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the host part of the url passed to urlopen()",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue30458#msg347282",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1727276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://security.netapp.com/advisory/ntap-20191107-0004/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18348",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: infinite loop in the tarfile module via crafted TAR archive",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html",
              "https://bugs.python.org/issue39017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907",
              "https://github.com/python/cpython/pull/21454",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200731-0002/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20907",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 7.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via HTTP request method in httplib/http.client",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.python.org/issue39603",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/",
              "https://python-security.readthedocs.io/vuln/http-header-injection-method.html"
            ],
            "Description": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-26116",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS",
            "PkgName": "python-devel",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8492.html",
              "http://linux.oracle.com/errata/ELSA-2020-3888.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "https://bugs.python.org/issue39503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492",
              "https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4",
              "https://github.com/python/cpython/pull/18284",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html",
              "https://security.gentoo.org/glsa/202005-09",
              "https://security.netapp.com/advisory/ntap-20200221-0001/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8492",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.3,
                "V3Score": 3.6,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 3.6,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Heap-Buffer-Overflow and Heap-Use-After-Free in Objects/fileobject.c",
            "PkgName": "python-devel",
            "Severity": "LOW",
            "References": [
              "https://bugs.python.org/issue31530",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000030",
              "https://drive.google.com/file/d/1oyR9DAZjZK_SCn3mor6NRAYLJS6ueXaY/view",
              "https://security.gentoo.org/glsa/201811-02",
              "https://usn.ubuntu.com/3817-1/",
              "https://usn.ubuntu.com/3817-2/",
              "https://usn.ubuntu.com/usn/usn-3817-1",
              "https://usn.ubuntu.com/usn/usn-3817-2",
              "https://www.dropbox.com/sh/sj3ee7xv55j36k7/AADwP-YfOYikBMuy32e0uvPFa?dl=0",
              "https://www.oracle.com/security-alerts/cpujan2020.html"
            ],
            "Description": "Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1000030",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Nested zip file (Zip bomb) vulnerability in Lib/zipfile.py",
            "PkgName": "python-devel",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue36260",
              "https://bugs.python.org/issue36462",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9674",
              "https://github.com/python/cpython/blob/master/Lib/zipfile.py",
              "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb",
              "https://security.netapp.com/advisory/ntap-20200221-0003/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1",
              "https://www.python.org/news/security/"
            ],
            "Description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9674",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: DoS via inefficiency in IPv{4,6}Interface classes",
            "PkgName": "python-ipaddress",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html",
              "https://bugs.python.org/issue41004",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422",
              "https://github.com/python/cpython/pull/20956",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200724-0004/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-14422",
            "InstalledVersion": "1.0.16-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Python xml bindings: Internal entity expansion in Python XML libraries inflicts DoS vulnerabilities",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://blog.python.org/2013/02/announcing-defusedxms-fixes-for-xml.html",
              "http://bugs.python.org/issue17239",
              "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0657.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0658.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0670.html",
              "http://ubuntu.com/usn/usn-1757-1",
              "http://www.openwall.com/lists/oss-security/2013/02/19/2",
              "http://www.openwall.com/lists/oss-security/2013/02/19/4",
              "https://bugs.launchpad.net/nova/+bug/1100282",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1664",
              "https://usn.ubuntu.com/usn/usn-1730-1",
              "https://usn.ubuntu.com/usn/usn-1731-1",
              "https://usn.ubuntu.com/usn/usn-1734-1",
              "https://usn.ubuntu.com/usn/usn-1757-1",
              "https://www.djangoproject.com/weblog/2013/feb/19/security/"
            ],
            "Description": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-1664",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 5.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Python xml bindings: External entity expansion in Python XML libraries inflicts potential security flaws and DoS vulnerabilities",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://blog.python.org/2013/02/announcing-defusedxms-fixes-for-xml.html",
              "http://bugs.python.org/issue17239",
              "http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0657.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0658.html",
              "http://rhn.redhat.com/errata/RHSA-2013-0670.html",
              "http://ubuntu.com/usn/usn-1757-1",
              "http://www.debian.org/security/2013/dsa-2634",
              "http://www.openwall.com/lists/oss-security/2013/02/19/2",
              "http://www.openwall.com/lists/oss-security/2013/02/19/4",
              "https://bugs.launchpad.net/keystone/+bug/1100279",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1665",
              "https://usn.ubuntu.com/usn/usn-1730-1",
              "https://usn.ubuntu.com/usn/usn-1757-1",
              "https://www.djangoproject.com/weblog/2013/feb/19/security/"
            ],
            "Description": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-1665",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: hash secret can be recovered remotely",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://bugs.python.org/issue14621",
              "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html",
              "http://www.openwall.com/lists/oss-security/2013/12/09/13",
              "http://www.openwall.com/lists/oss-security/2013/12/09/3",
              "http://www.securityfocus.com/bid/64194",
              "https://support.apple.com/kb/HT205031"
            ],
            "Description": "Python 2.7 before 3.4 only uses the last eight bits of the prefix to randomize hash values, which causes it to compute hash values without restricting the ability to trigger hash collisions predictably and makes it easier for context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1150.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-7040",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.1,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Integer overflow in PyString_DecodeEscape results in heap-base buffer overflow",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://python-security.readthedocs.io/vuln/cve-2017-1000158_pystring_decodeescape_integer_overflow.html",
              "http://www.securitytracker.com/id/1039890",
              "https://bugs.python.org/issue30657",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000158",
              "https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html",
              "https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
              "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
              "https://security.gentoo.org/glsa/201805-02",
              "https://usn.ubuntu.com/usn/usn-3496-1",
              "https://usn.ubuntu.com/usn/usn-3496-2",
              "https://usn.ubuntu.com/usn/usn-3496-3",
              "https://www.debian.org/security/2018/dsa-4307"
            ],
            "Description": "CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000158",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Cookie domain check returns incorrect results",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20852.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue35121",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
            "FixedVersion": "2.7.5-88.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20852",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: email.utils.parseaddr wrongly parses email addresses",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16056.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue34155",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
              "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20190926-0005/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
            "FixedVersion": "2.7.5-88.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16056",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16935.html",
              "http://linux.oracle.com/errata/ELSA-2020-3911.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://bugs.python.org/issue38243",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935",
              "https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897",
              "https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213",
              "https://github.com/python/cpython/pull/16373",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20191017-0004/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.",
            "FixedVersion": "2.7.5-89.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16935",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the host part of the url passed to urlopen()",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue30458#msg347282",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1727276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://security.netapp.com/advisory/ntap-20191107-0004/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18348",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: infinite loop in the tarfile module via crafted TAR archive",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html",
              "https://bugs.python.org/issue39017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907",
              "https://github.com/python/cpython/pull/21454",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200731-0002/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20907",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 7.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via HTTP request method in httplib/http.client",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.python.org/issue39603",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/",
              "https://python-security.readthedocs.io/vuln/http-header-injection-method.html"
            ],
            "Description": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-26116",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS",
            "PkgName": "python-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8492.html",
              "http://linux.oracle.com/errata/ELSA-2020-3888.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "https://bugs.python.org/issue39503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492",
              "https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4",
              "https://github.com/python/cpython/pull/18284",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html",
              "https://security.gentoo.org/glsa/202005-09",
              "https://security.netapp.com/advisory/ntap-20200221-0001/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8492",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.3,
                "V3Score": 3.6,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              },
              "redhat": {
                "V3Score": 3.6,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Heap-Buffer-Overflow and Heap-Use-After-Free in Objects/fileobject.c",
            "PkgName": "python-libs",
            "Severity": "LOW",
            "References": [
              "https://bugs.python.org/issue31530",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000030",
              "https://drive.google.com/file/d/1oyR9DAZjZK_SCn3mor6NRAYLJS6ueXaY/view",
              "https://security.gentoo.org/glsa/201811-02",
              "https://usn.ubuntu.com/3817-1/",
              "https://usn.ubuntu.com/3817-2/",
              "https://usn.ubuntu.com/usn/usn-3817-1",
              "https://usn.ubuntu.com/usn/usn-3817-2",
              "https://www.dropbox.com/sh/sj3ee7xv55j36k7/AADwP-YfOYikBMuy32e0uvPFa?dl=0",
              "https://www.oracle.com/security-alerts/cpujan2020.html"
            ],
            "Description": "Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears that Python 2.7.17 and prior may also be vulnerable however this has not been confirmed. The vulnerability lies when multiply threads are handling large amounts of data. In both cases there is essentially a race condition that occurs. For the Heap-Buffer-Overflow, Thread 2 is creating the size for a buffer, but Thread1 is already writing to the buffer without knowing how much to write. So when a large amount of data is being processed, it is very easy to cause memory corruption using a Heap-Buffer-Overflow. As for the Use-After-Free, Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRT has stated that this is not a security vulnerability due to the fact that the attacker must be able to run code, however in some situations, such as function as a service, this vulnerability can potentially be used by an attacker to violate a trust boundary, as such the DWF feels this issue deserves a CVE.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-1000030",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Nested zip file (Zip bomb) vulnerability in Lib/zipfile.py",
            "PkgName": "python-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue36260",
              "https://bugs.python.org/issue36462",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9674",
              "https://github.com/python/cpython/blob/master/Lib/zipfile.py",
              "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb",
              "https://security.netapp.com/advisory/ntap-20200221-0003/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1",
              "https://www.python.org/news/security/"
            ],
            "Description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9674",
            "InstalledVersion": "2.7.5-86.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
              },
              "redhat": {
                "V2Score": 2.6,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-requests: Proxy-Authorization header leak",
            "PkgName": "python-requests",
            "Severity": "LOW",
            "References": [
              "http://advisories.mageia.org/MGASA-2014-0409.html",
              "http://lists.opensuse.org/opensuse-updates/2016-01/msg00095.html",
              "http://www.debian.org/security/2015/dsa-3146",
              "http://www.mandriva.com/security/advisories?name=MDVSA-2015:133",
              "http://www.openwall.com/lists/oss-security/2014/09/19",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733108",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1830",
              "https://github.com/kennethreitz/requests/issues/1885",
              "https://github.com/victims/victims-cve-db/blob/master/database/python/2014/1830.yaml",
              "https://usn.ubuntu.com/usn/usn-2382-1"
            ],
            "Description": "Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-1830",
            "InstalledVersion": "2.6.0-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.6,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-rtslib: weak permissions for /etc/target/saveconfig.json",
            "PkgName": "python-rtslib",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14019",
              "https://github.com/open-iscsi/rtslib-fb/pull/162",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH/"
            ],
            "Description": "Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-14019",
            "InstalledVersion": "2.1.fb69-3.el7"
          },
          {
            "CVSS": {
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-urllib3: CRLF injection via HTTP request method",
            "PkgName": "python-urllib3",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.python.org/issue39603",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26137",
              "https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b",
              "https://github.com/urllib3/urllib3/pull/1800",
              "https://usn.ubuntu.com/usn/usn-4570-1"
            ],
            "Description": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-26137",
            "InstalledVersion": "1.10.2-7.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 4,
                "V3Score": 4.8,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-cryptography: HKDF might return an empty byte-string",
            "PkgName": "python2-cryptography",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/11/08/6",
              "http://www.openwall.com/lists/oss-security/2016/11/09/2",
              "http://www.securityfocus.com/bid/94216",
              "http://www.ubuntu.com/usn/USN-3138-1",
              "https://cryptography.io/en/latest/changelog",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9243",
              "https://github.com/pyca/cryptography/commit/b924696b2e8731f39696584d12cceeb3aeb2d874",
              "https://github.com/pyca/cryptography/issues/3211",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5R2ZOBMPWDFFHUZ6QOZZY36A6H5CGJXL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U23KDR2M2N7W2ZSREG63BVW7D4VC6CIZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQ5G7KHKZC4SI23JE7277KZXM57GEQKT/",
              "https://usn.ubuntu.com/usn/usn-3138-1"
            ],
            "Description": "HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-9243",
            "InstalledVersion": "1.7.2-2.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Cookie domain check returns incorrect results",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20852.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue35121",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
            "FixedVersion": "3.6.8-13.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20852",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: email.utils.parseaddr wrongly parses email addresses",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16056.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue34155",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
              "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20190926-0005/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
            "FixedVersion": "3.6.8-13.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16056",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16935.html",
              "http://linux.oracle.com/errata/ELSA-2020-3911.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://bugs.python.org/issue38243",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935",
              "https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897",
              "https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213",
              "https://github.com/python/cpython/pull/16373",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20191017-0004/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.",
            "FixedVersion": "3.6.8-17.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16935",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the host part of the url passed to urlopen()",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue30458#msg347282",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1727276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://security.netapp.com/advisory/ntap-20191107-0004/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18348",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: infinite loop in the tarfile module via crafted TAR archive",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html",
              "https://bugs.python.org/issue39017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907",
              "https://github.com/python/cpython/pull/21454",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200731-0002/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20907",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the query part of the url passed to urlopen()",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-9740.html",
              "http://linux.oracle.com/errata/ELSA-2019-3520.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html",
              "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html",
              "http://www.securityfocus.com/bid/107466",
              "https://access.redhat.com/errata/RHSA-2019:1260",
              "https://access.redhat.com/errata/RHSA-2019:2030",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3520",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://bugs.python.org/issue36276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
              "https://seclists.org/bugtraq/2019/Oct/29",
              "https://security.gentoo.org/glsa/202003-26",
              "https://security.netapp.com/advisory/ntap-20190619-0005/",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9740",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the path part of the url passed to urlopen()",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-9947.html",
              "http://linux.oracle.com/errata/ELSA-2019-3520.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:1260",
              "https://access.redhat.com/errata/RHSA-2019:2030",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3520",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://bugs.python.org/issue35906",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9947",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
              "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://security.netapp.com/advisory/ntap-20190404-0004/",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9947",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: DoS via inefficiency in IPv{4,6}Interface classes",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html",
              "https://bugs.python.org/issue41004",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422",
              "https://github.com/python/cpython/pull/20956",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200724-0004/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-14422",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 7.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via HTTP request method in httplib/http.client",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.python.org/issue39603",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/",
              "https://python-security.readthedocs.io/vuln/http-header-injection-method.html"
            ],
            "Description": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-26116",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS",
            "PkgName": "python3",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8492.html",
              "http://linux.oracle.com/errata/ELSA-2020-3888.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "https://bugs.python.org/issue39503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492",
              "https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4",
              "https://github.com/python/cpython/pull/18284",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html",
              "https://security.gentoo.org/glsa/202005-09",
              "https://security.netapp.com/advisory/ntap-20200221-0001/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.",
            "FixedVersion": "3.6.8-17.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8492",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Nested zip file (Zip bomb) vulnerability in Lib/zipfile.py",
            "PkgName": "python3",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue36260",
              "https://bugs.python.org/issue36462",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9674",
              "https://github.com/python/cpython/blob/master/Lib/zipfile.py",
              "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb",
              "https://security.netapp.com/advisory/ntap-20200221-0003/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1",
              "https://www.python.org/news/security/"
            ],
            "Description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9674",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Cookie domain check returns incorrect results",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20852.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue35121",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00040.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
            "FixedVersion": "3.6.8-13.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20852",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: email.utils.parseaddr wrongly parses email addresses",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16056.html",
              "http://linux.oracle.com/errata/ELSA-2020-1764.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://access.redhat.com/errata/RHSA-2019:3948",
              "https://bugs.python.org/issue34155",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
              "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
              "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
              "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20190926-0005/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
            "FixedVersion": "3.6.8-13.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16056",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.1,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: XSS vulnerability in the documentation XML-RPC server in server_title field",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-16935.html",
              "http://linux.oracle.com/errata/ELSA-2020-3911.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://bugs.python.org/issue38243",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16935",
              "https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897",
              "https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213",
              "https://github.com/python/cpython/pull/16373",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/",
              "https://security.netapp.com/advisory/ntap-20191017-0004/",
              "https://usn.ubuntu.com/4151-1/",
              "https://usn.ubuntu.com/4151-2/",
              "https://usn.ubuntu.com/usn/usn-4151-1",
              "https://usn.ubuntu.com/usn/usn-4151-2",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.",
            "FixedVersion": "3.6.8-17.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-16935",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the host part of the url passed to urlopen()",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue30458#msg347282",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1727276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18348",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://security.netapp.com/advisory/ntap-20191107-0004/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.)",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18348",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: infinite loop in the tarfile module via crafted TAR archive",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html",
              "https://bugs.python.org/issue39017",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20907",
              "https://github.com/python/cpython/pull/21454",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200731-0002/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20907",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the query part of the url passed to urlopen()",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-9740.html",
              "http://linux.oracle.com/errata/ELSA-2019-3520.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html",
              "http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html",
              "http://www.securityfocus.com/bid/107466",
              "https://access.redhat.com/errata/RHSA-2019:1260",
              "https://access.redhat.com/errata/RHSA-2019:2030",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3520",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://bugs.python.org/issue36276",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/",
              "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
              "https://seclists.org/bugtraq/2019/Oct/29",
              "https://security.gentoo.org/glsa/202003-26",
              "https://security.netapp.com/advisory/ntap-20190619-0005/",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9740",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via the path part of the url passed to urlopen()",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-9947.html",
              "http://linux.oracle.com/errata/ELSA-2019-3520.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
              "https://access.redhat.com/errata/RHSA-2019:1260",
              "https://access.redhat.com/errata/RHSA-2019:2030",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3520",
              "https://access.redhat.com/errata/RHSA-2019:3725",
              "https://bugs.python.org/issue35906",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9947",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
              "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
              "https://security.gentoo.org/glsa/202003-26",
              "https://security.netapp.com/advisory/ntap-20190404-0004/",
              "https://usn.ubuntu.com/4127-1/",
              "https://usn.ubuntu.com/4127-2/",
              "https://usn.ubuntu.com/usn/usn-4127-1",
              "https://usn.ubuntu.com/usn/usn-4127-2"
            ],
            "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9947",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: DoS via inefficiency in IPv{4,6}Interface classes",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html",
              "https://bugs.python.org/issue41004",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422",
              "https://github.com/python/cpython/pull/20956",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200724-0004/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-14422",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 7.2,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: CRLF injection via HTTP request method in httplib/http.client",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.python.org/issue39603",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/",
              "https://python-security.readthedocs.io/vuln/http-header-injection-method.html"
            ],
            "Description": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-26116",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.1,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS",
            "PkgName": "python3-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2020-8492.html",
              "http://linux.oracle.com/errata/ELSA-2020-3888.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "https://bugs.python.org/issue39503",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492",
              "https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4",
              "https://github.com/python/cpython/pull/18284",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/",
              "https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html",
              "https://security.gentoo.org/glsa/202005-09",
              "https://security.netapp.com/advisory/ntap-20200221-0001/",
              "https://usn.ubuntu.com/4333-1/",
              "https://usn.ubuntu.com/4333-2/",
              "https://usn.ubuntu.com/usn/usn-4333-1",
              "https://usn.ubuntu.com/usn/usn-4333-2"
            ],
            "Description": "Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.",
            "FixedVersion": "3.6.8-17.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-8492",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: Nested zip file (Zip bomb) vulnerability in Lib/zipfile.py",
            "PkgName": "python3-libs",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html",
              "https://bugs.python.org/issue36260",
              "https://bugs.python.org/issue36462",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9674",
              "https://github.com/python/cpython/blob/master/Lib/zipfile.py",
              "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb",
              "https://security.netapp.com/advisory/ntap-20200221-0003/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1",
              "https://www.python.org/news/security/"
            ],
            "Description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9674",
            "InstalledVersion": "3.6.8-10.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure",
            "PkgName": "python3-pip",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2018-20060.html",
              "http://linux.oracle.com/errata/ELSA-2020-2081.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html",
              "https://access.redhat.com/errata/RHSA-2019:2272",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1649153",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20060",
              "https://github.com/advisories/GHSA-www2-v7xj-xrc6",
              "https://github.com/urllib3/urllib3/blob/master/CHANGES.rst",
              "https://github.com/urllib3/urllib3/issues/1316",
              "https://github.com/urllib3/urllib3/pull/1346",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5SJERZEJDSUYQP7BNBXMBHRHGY26HRZD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BXLAXHM3Z6DUCXZ7ZXZ2EAYJXWDCZFCT/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWP36YW3KSVLXDBY3QJKDYEPCIMN3VQZ/",
              "https://nvd.nist.gov/vuln/detail/CVE-2018-20060",
              "https://usn.ubuntu.com/3990-1/",
              "https://usn.ubuntu.com/usn/usn-3990-1"
            ],
            "Description": "urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
            "FixedVersion": "9.0.3-7.el7_8",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20060",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.1,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-urllib3: CRLF injection due to not encoding the '\\r\\n' sequence leading to possible attack on internal service",
            "PkgName": "python3-pip",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11236.html",
              "http://linux.oracle.com/errata/ELSA-2020-2081.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html",
              "https://access.redhat.com/errata/RHSA-2019:2272",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3590",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11236",
              "https://github.com/urllib3/urllib3/issues/1553",
              "https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R62XGEYPUTXMRHGX5I37EBCGQ5COHGKR/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TBI45HO533KYHNB5YRO43TBYKA3E3VRL/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/",
              "https://usn.ubuntu.com/3990-1/",
              "https://usn.ubuntu.com/3990-2/",
              "https://usn.ubuntu.com/usn/usn-3990-1",
              "https://usn.ubuntu.com/usn/usn-3990-2"
            ],
            "Description": "In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.",
            "FixedVersion": "9.0.3-7.el7_8",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11236",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-urllib3: Certification mishandle when error should be thrown",
            "PkgName": "python3-pip",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-11324.html",
              "http://linux.oracle.com/errata/ELSA-2020-2068.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html",
              "http://www.openwall.com/lists/oss-security/2019/04/19/1",
              "https://access.redhat.com/errata/RHSA-2019:3335",
              "https://access.redhat.com/errata/RHSA-2019:3590",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11324",
              "https://github.com/advisories/GHSA-mh33-7rrq-662w",
              "https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/",
              "https://nvd.nist.gov/vuln/detail/CVE-2019-11324",
              "https://usn.ubuntu.com/3990-1/",
              "https://usn.ubuntu.com/usn/usn-3990-1",
              "https://www.openwall.com/lists/oss-security/2019/04/17/3"
            ],
            "Description": "The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
            "FixedVersion": "9.0.3-7.el7_8",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-11324",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 8,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py",
            "PkgName": "python3-pip",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20916",
              "https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace",
              "https://github.com/pypa/pip/compare/19.1.1...19.2",
              "https://github.com/pypa/pip/issues/6413",
              "https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html"
            ],
            "Description": "The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20916",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.9,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.9,
                "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python: DoS via inefficiency in IPv{4,6}Interface classes",
            "PkgName": "python3-pip",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html",
              "https://bugs.python.org/issue41004",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14422",
              "https://github.com/python/cpython/pull/20956",
              "https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/",
              "https://security.gentoo.org/glsa/202008-01",
              "https://security.netapp.com/advisory/ntap-20200724-0004/",
              "https://usn.ubuntu.com/4428-1/",
              "https://usn.ubuntu.com/usn/usn-4428-1"
            ],
            "Description": "Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-14422",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 2.6,
                "V3Vector": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-requests: Redirect from HTTPS to HTTP does not remove Authorization header",
            "PkgName": "python3-pip",
            "Severity": "LOW",
            "References": [
              "http://docs.python-requests.org/en/master/community/updates/#release-and-version-history",
              "http://linux.oracle.com/cve/CVE-2018-18074.html",
              "http://linux.oracle.com/errata/ELSA-2020-2081.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00024.html",
              "https://access.redhat.com/errata/RHSA-2019:2035",
              "https://bugs.debian.org/910766",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18074",
              "https://github.com/advisories/GHSA-x84v-xcm2-53pg",
              "https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff",
              "https://github.com/requests/requests/issues/4716",
              "https://github.com/requests/requests/pull/4718",
              "https://nvd.nist.gov/vuln/detail/CVE-2018-18074",
              "https://usn.ubuntu.com/3790-1/",
              "https://usn.ubuntu.com/3790-2/",
              "https://usn.ubuntu.com/usn/usn-3790-1",
              "https://usn.ubuntu.com/usn/usn-3790-2"
            ],
            "Description": "The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.",
            "FixedVersion": "9.0.3-7.el7_8",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-18074",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "python-pip: when --extra-index-url option is used and package does not already exist in the public index, the installation of malicious package with arbitrary version number is possible.",
            "PkgName": "python3-pip",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1835736",
              "https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html",
              "https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2@%3Cgithub.arrow.apache.org%3E",
              "https://pip.pypa.io/en/stable/news/"
            ],
            "Description": "** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20225",
            "InstalledVersion": "9.0.3-5.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.9,
                "V3Score": 4.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 3.6,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: Possible info leak via INPUTRC",
            "PkgName": "readline",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2016-7091.html",
              "http://linux.oracle.com/errata/ELSA-2016-2593.html",
              "http://www.securityfocus.com/bid/92615",
              "https://lists.gnu.org/archive/html/bug-readline/2016-05/msg00009.html",
              "https://rhn.redhat.com/errata/RHSA-2016-2593.html"
            ],
            "Description": "sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-7091",
            "InstalledVersion": "6.2-11.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to directories when installing packages allows privilege escalation",
            "PkgName": "rpm",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1450369",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7500",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7500",
              "https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9",
              "https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79"
            ],
            "Description": "It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7500",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to files when installing packages allows privilege escalation",
            "PkgName": "rpm",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1452133",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7501",
              "https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc",
              "https://security.gentoo.org/glsa/201811-22"
            ],
            "Description": "It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7501",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to directories when installing packages allows privilege escalation",
            "PkgName": "rpm-build-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1450369",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7500",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7500",
              "https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9",
              "https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79"
            ],
            "Description": "It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7500",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to files when installing packages allows privilege escalation",
            "PkgName": "rpm-build-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1452133",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7501",
              "https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc",
              "https://security.gentoo.org/glsa/201811-22"
            ],
            "Description": "It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7501",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to directories when installing packages allows privilege escalation",
            "PkgName": "rpm-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1450369",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7500",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7500",
              "https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9",
              "https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79"
            ],
            "Description": "It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7500",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to files when installing packages allows privilege escalation",
            "PkgName": "rpm-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1452133",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7501",
              "https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc",
              "https://security.gentoo.org/glsa/201811-22"
            ],
            "Description": "It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7501",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to directories when installing packages allows privilege escalation",
            "PkgName": "rpm-python",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1450369",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7500",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7500",
              "https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9",
              "https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79"
            ],
            "Description": "It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7500",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rpm: Following symlinks to files when installing packages allows privilege escalation",
            "PkgName": "rpm-python",
            "Severity": "MEDIUM",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1452133",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7501",
              "https://github.com/rpm-software-management/rpm/commit/404ef011c300207cdb1e531670384564aae04bdc",
              "https://security.gentoo.org/glsa/201811-22"
            ],
            "Description": "It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7501",
            "InstalledVersion": "4.11.3-40.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c",
            "PkgName": "rsyslog",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17041.html",
              "http://linux.oracle.com/errata/ELSA-2020-1702.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00032.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17041",
              "https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog",
              "https://github.com/rsyslog/rsyslog/pull/3884",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6SUQE25RD37CD24BHKUWMG27U5RQ2FU/"
            ],
            "Description": "An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.",
            "FixedVersion": "8.24.0-52.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17041",
            "InstalledVersion": "8.24.0-41.el7_7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c",
            "PkgName": "rsyslog",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-17042.html",
              "http://linux.oracle.com/errata/ELSA-2020-1702.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00031.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00032.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17042",
              "https://github.com/rsyslog/rsyslog/blob/v8-stable/ChangeLog",
              "https://github.com/rsyslog/rsyslog/pull/3883",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPNCHI7X2IEXRH6RYD6IDPR4PLB5RPC7/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6SUQE25RD37CD24BHKUWMG27U5RQ2FU/"
            ],
            "Description": "An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.",
            "FixedVersion": "8.24.0-52.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-17042",
            "InstalledVersion": "8.24.0-41.el7_7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "rsyslog: some log files are created world-readable",
            "PkgName": "rsyslog",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/06/18/12",
              "http://www.openwall.com/lists/oss-security/2015/06/20/3",
              "http://www.securityfocus.com/bid/75298",
              "http://www.securitytracker.com/id/1032885",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1232826"
            ],
            "Description": "rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3243",
            "InstalledVersion": "8.24.0-41.el7_7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 9.3,
                "V3Score": 10,
                "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 9.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Samba: Netlogon Elevation of Privilege Vulnerability (Zerologon)",
            "PkgName": "samba-client-libs",
            "Severity": "CRITICAL",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html",
              "http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html",
              "http://www.openwall.com/lists/oss-security/2020/09/17/2",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472",
              "https://kb.cert.org/vuls/id/490028#Samba",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/",
              "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472",
              "https://usn.ubuntu.com/4510-1/",
              "https://usn.ubuntu.com/4510-2/",
              "https://usn.ubuntu.com/4559-1/",
              "https://usn.ubuntu.com/usn/usn-4510-1",
              "https://usn.ubuntu.com/usn/usn-4510-2",
              "https://www.kb.cert.org/vuls/id/490028",
              "https://www.samba.org/samba/security/CVE-2020-1472.html",
              "https://www.secura.com/pathtoimg.php?id=2055",
              "https://www.synology.com/security/advisory/Synology_SA_20_21"
            ],
            "Description": "An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1472",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Combination of parameters and permissions can allow user to escape from the share path definition",
            "PkgName": "samba-client-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10197.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html",
              "https://access.redhat.com/errata/RHSA-2019:3253",
              "https://access.redhat.com/errata/RHSA-2019:4023",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10197",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/",
              "https://seclists.org/bugtraq/2019/Sep/4",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20190903-0001/",
              "https://support.f5.com/csp/article/K69511801",
              "https://support.f5.com/csp/article/K69511801?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4121-1/",
              "https://usn.ubuntu.com/usn/usn-4121-1",
              "https://www.debian.org/security/2019/dsa-4513",
              "https://www.samba.org/samba/security/CVE-2019-10197.html"
            ],
            "Description": "A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10197",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: smb client vulnerable to filenames containing path separators",
            "PkgName": "samba-client-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10218.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10218",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/",
              "https://usn.ubuntu.com/usn/usn-4167-1",
              "https://usn.ubuntu.com/usn/usn-4167-2",
              "https://www.samba.org/samba/security/CVE-2019-10218.html",
              "https://www.synology.com/security/advisory/Synology_SA_19_35"
            ],
            "Description": "A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10218",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Crash after failed character conversion at log level 3 or above",
            "PkgName": "samba-client-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14907.html",
              "http://linux.oracle.com/errata/ELSA-2020-3981.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14907",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20200122-0001/",
              "https://usn.ubuntu.com/4244-1/",
              "https://usn.ubuntu.com/usn/usn-4244-1",
              "https://www.samba.org/samba/security/CVE-2019-14907.html",
              "https://www.synology.com/security/advisory/Synology_SA_20_01"
            ],
            "Description": "All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with \"log level = 3\" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).",
            "FixedVersion": "4.10.16-5.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14907",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 9.3,
                "V3Score": 10,
                "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 9.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Samba: Netlogon Elevation of Privilege Vulnerability (Zerologon)",
            "PkgName": "samba-common",
            "Severity": "CRITICAL",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html",
              "http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html",
              "http://www.openwall.com/lists/oss-security/2020/09/17/2",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472",
              "https://kb.cert.org/vuls/id/490028#Samba",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/",
              "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472",
              "https://usn.ubuntu.com/4510-1/",
              "https://usn.ubuntu.com/4510-2/",
              "https://usn.ubuntu.com/4559-1/",
              "https://usn.ubuntu.com/usn/usn-4510-1",
              "https://usn.ubuntu.com/usn/usn-4510-2",
              "https://www.kb.cert.org/vuls/id/490028",
              "https://www.samba.org/samba/security/CVE-2020-1472.html",
              "https://www.secura.com/pathtoimg.php?id=2055",
              "https://www.synology.com/security/advisory/Synology_SA_20_21"
            ],
            "Description": "An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1472",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Combination of parameters and permissions can allow user to escape from the share path definition",
            "PkgName": "samba-common",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10197.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html",
              "https://access.redhat.com/errata/RHSA-2019:3253",
              "https://access.redhat.com/errata/RHSA-2019:4023",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10197",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/",
              "https://seclists.org/bugtraq/2019/Sep/4",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20190903-0001/",
              "https://support.f5.com/csp/article/K69511801",
              "https://support.f5.com/csp/article/K69511801?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4121-1/",
              "https://usn.ubuntu.com/usn/usn-4121-1",
              "https://www.debian.org/security/2019/dsa-4513",
              "https://www.samba.org/samba/security/CVE-2019-10197.html"
            ],
            "Description": "A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10197",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: smb client vulnerable to filenames containing path separators",
            "PkgName": "samba-common",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10218.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10218",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/",
              "https://usn.ubuntu.com/usn/usn-4167-1",
              "https://usn.ubuntu.com/usn/usn-4167-2",
              "https://www.samba.org/samba/security/CVE-2019-10218.html",
              "https://www.synology.com/security/advisory/Synology_SA_19_35"
            ],
            "Description": "A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10218",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Crash after failed character conversion at log level 3 or above",
            "PkgName": "samba-common",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14907.html",
              "http://linux.oracle.com/errata/ELSA-2020-3981.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14907",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20200122-0001/",
              "https://usn.ubuntu.com/4244-1/",
              "https://usn.ubuntu.com/usn/usn-4244-1",
              "https://www.samba.org/samba/security/CVE-2019-14907.html",
              "https://www.synology.com/security/advisory/Synology_SA_20_01"
            ],
            "Description": "All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with \"log level = 3\" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).",
            "FixedVersion": "4.10.16-5.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14907",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 9.3,
                "V3Score": 10,
                "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 9.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "Samba: Netlogon Elevation of Privilege Vulnerability (Zerologon)",
            "PkgName": "samba-common-libs",
            "Severity": "CRITICAL",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html",
              "http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html",
              "http://www.openwall.com/lists/oss-security/2020/09/17/2",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472",
              "https://kb.cert.org/vuls/id/490028#Samba",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/",
              "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472",
              "https://usn.ubuntu.com/4510-1/",
              "https://usn.ubuntu.com/4510-2/",
              "https://usn.ubuntu.com/4559-1/",
              "https://usn.ubuntu.com/usn/usn-4510-1",
              "https://usn.ubuntu.com/usn/usn-4510-2",
              "https://www.kb.cert.org/vuls/id/490028",
              "https://www.samba.org/samba/security/CVE-2020-1472.html",
              "https://www.secura.com/pathtoimg.php?id=2055",
              "https://www.synology.com/security/advisory/Synology_SA_20_21"
            ],
            "Description": "An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-1472",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.4,
                "V3Score": 9.1,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Combination of parameters and permissions can allow user to escape from the share path definition",
            "PkgName": "samba-common-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10197.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00045.html",
              "https://access.redhat.com/errata/RHSA-2019:3253",
              "https://access.redhat.com/errata/RHSA-2019:4023",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10197",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10197",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56ZUXHGDHPM7S6RVAKULZT5EATS37OKA/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7NYIUZOCIDXWXGWMZ7O5Z7OJ6IX7EAB/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z6EEKFT24DQI4DMZMSQTLMNZWG4RMZ57/",
              "https://seclists.org/bugtraq/2019/Sep/4",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20190903-0001/",
              "https://support.f5.com/csp/article/K69511801",
              "https://support.f5.com/csp/article/K69511801?utm_source=f5support&amp;utm_medium=RSS",
              "https://usn.ubuntu.com/4121-1/",
              "https://usn.ubuntu.com/usn/usn-4121-1",
              "https://www.debian.org/security/2019/dsa-4513",
              "https://www.samba.org/samba/security/CVE-2019-10197.html"
            ],
            "Description": "A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file. An unauthenticated attacker could use this flaw to escape the shared directory and access the contents of directories outside the share.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10197",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: smb client vulnerable to filenames containing path separators",
            "PkgName": "samba-common-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-10218.html",
              "http://linux.oracle.com/errata/ELSA-2020-1878.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10218",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/",
              "https://usn.ubuntu.com/usn/usn-4167-1",
              "https://usn.ubuntu.com/usn/usn-4167-2",
              "https://www.samba.org/samba/security/CVE-2019-10218.html",
              "https://www.synology.com/security/advisory/Synology_SA_19_35"
            ],
            "Description": "A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.",
            "FixedVersion": "4.10.4-10.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-10218",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.6,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "samba: Crash after failed character conversion at log level 3 or above",
            "PkgName": "samba-common-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14907.html",
              "http://linux.oracle.com/errata/ELSA-2020-3981.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00055.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14907",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14907",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ACZVNMIFQGGXNJPMHAVBN3H2U65FXQY/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GQ6U65I2K23YJC4FESW477WL55TU3PPT/",
              "https://security.gentoo.org/glsa/202003-52",
              "https://security.netapp.com/advisory/ntap-20200122-0001/",
              "https://usn.ubuntu.com/4244-1/",
              "https://usn.ubuntu.com/usn/usn-4244-1",
              "https://www.samba.org/samba/security/CVE-2019-14907.html",
              "https://www.synology.com/security/advisory/Synology_SA_20_01"
            ],
            "Description": "All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with \"log level = 3\" (or above) then the string obtained from the client, after a failed character conversion, is printed. Such strings can be provided during the NTLMSSP authentication exchange. In the Samba AD DC in particular, this may cause a long-lived process(such as the RPC server) to terminate. (In the file server case, the most likely target, smbd, operates as process-per-client and so a crash there is harmless).",
            "FixedVersion": "4.10.16-5.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14907",
            "InstalledVersion": "4.9.1-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "selinux-policy: policy package update causes denial of service",
            "PkgName": "selinux-policy",
            "Severity": "LOW",
            "References": ["https://bugzilla.redhat.com/show_bug.cgi?id=1218672"],
            "Description": "selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3170",
            "InstalledVersion": "3.13.1-252.el7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V2Score": 1.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:N/I:N/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "selinux-policy: policy package update causes denial of service",
            "PkgName": "selinux-policy-minimum",
            "Severity": "LOW",
            "References": ["https://bugzilla.redhat.com/show_bug.cgi?id=1218672"],
            "Description": "selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by creating a hardlink to /etc/passwd from a directory named .config, and updating selinux-policy.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-3170",
            "InstalledVersion": "3.13.1-252.el7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 4.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V3Score": 4.8,
                "V3Vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "gnome-shell: partial lock screen bypass",
            "PkgName": "shared-mime-info",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-3820.html",
              "http://linux.oracle.com/errata/ELSA-2020-1021.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00023.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00049.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3820",
              "https://gitlab.gnome.org/GNOME/gnome-shell/issues/851",
              "https://usn.ubuntu.com/3966-1/",
              "https://usn.ubuntu.com/usn/usn-3966-1"
            ],
            "Description": "It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions.",
            "FixedVersion": "1.8-5.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-3820",
            "InstalledVersion": "1.8-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.8,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: fts3: improve shadow table corruption detection",
            "PkgName": "sqlite",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-13734.html",
              "http://linux.oracle.com/errata/ELSA-2020-0273.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html",
              "https://access.redhat.com/errata/RHSA-2019:4238",
              "https://access.redhat.com/errata/RHSA-2020:0227",
              "https://access.redhat.com/errata/RHSA-2020:0229",
              "https://access.redhat.com/errata/RHSA-2020:0273",
              "https://access.redhat.com/errata/RHSA-2020:0451",
              "https://access.redhat.com/errata/RHSA-2020:0463",
              "https://access.redhat.com/errata/RHSA-2020:0476",
              "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html",
              "https://crbug.com/1025466",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13734",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5CIQCVS6E3ULJCNU7YJXJPO2BLQZDTK/",
              "https://seclists.org/bugtraq/2020/Jan/27",
              "https://security.gentoo.org/glsa/202003-08",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/4298-2/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://usn.ubuntu.com/usn/usn-4298-2",
              "https://www.debian.org/security/2020/dsa-4606"
            ],
            "Description": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
            "FixedVersion": "3.7.17-8.el7_7.1",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13734",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 8.8,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "chromium-browser: out-of-bounds access in SQLite",
            "PkgName": "sqlite",
            "Severity": "HIGH",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html",
              "https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.html",
              "https://crbug.com/952406",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5827",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI/",
              "https://seclists.org/bugtraq/2019/Aug/19",
              "https://security.gentoo.org/glsa/202003-16",
              "https://usn.ubuntu.com/4205-1/",
              "https://usn.ubuntu.com/usn/usn-4205-1",
              "https://www.debian.org/security/2019/dsa-4500"
            ],
            "Description": "Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-5827",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: arbitrary code execution on databases with malformed schema",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://support.apple.com/kb/HT204941",
              "http://support.apple.com/kb/HT204942",
              "http://zerodayinitiative.com/advisories/ZDI-15-570/",
              "https://security.gentoo.org/glsa/201612-21"
            ],
            "Description": "The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-7036",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "chromium-browser: pointer disclosure in sqlite",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://www.securityfocus.com/bid/98767",
              "http://www.securityfocus.com/bid/99950",
              "https://access.redhat.com/errata/RHSA-2017:1833",
              "https://chromereleases.googleblog.com/2017/07/stable-channel-update-for-desktop.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7000",
              "https://security.gentoo.org/glsa/201709-15",
              "https://support.apple.com/HT207797",
              "https://support.apple.com/HT207798",
              "https://www.debian.org/security/2017/dsa-3926",
              "https://www.sqlite.org/bindptr.html"
            ],
            "Description": "An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-7000",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: fts3: improve detection of corrupted records",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html",
              "https://access.redhat.com/errata/RHSA-2019:4238",
              "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html",
              "https://crbug.com/1025465",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13751",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5CIQCVS6E3ULJCNU7YJXJPO2BLQZDTK/",
              "https://seclists.org/bugtraq/2020/Jan/27",
              "https://security.gentoo.org/glsa/202003-08",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/4298-2/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://usn.ubuntu.com/usn/usn-4298-2",
              "https://www.debian.org/security/2020/dsa-4606"
            ],
            "Description": "Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13751",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: fts3: improve shadow table corruption detection",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-13752.html",
              "http://linux.oracle.com/errata/ELSA-2020-1810.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html",
              "https://access.redhat.com/errata/RHSA-2019:4238",
              "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html",
              "https://crbug.com/1025470",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13752",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5CIQCVS6E3ULJCNU7YJXJPO2BLQZDTK/",
              "https://seclists.org/bugtraq/2020/Jan/27",
              "https://security.gentoo.org/glsa/202003-08",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/4298-2/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://usn.ubuntu.com/usn/usn-4298-2",
              "https://www.debian.org/security/2020/dsa-4606"
            ],
            "Description": "Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13752",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 6.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 6.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: fts3: incorrectly removed corruption check",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-13753.html",
              "http://linux.oracle.com/errata/ELSA-2020-1810.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html",
              "https://access.redhat.com/errata/RHSA-2019:4238",
              "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html",
              "https://crbug.com/1025471",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13753",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N5CIQCVS6E3ULJCNU7YJXJPO2BLQZDTK/",
              "https://seclists.org/bugtraq/2020/Jan/27",
              "https://security.gentoo.org/glsa/202003-08",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/4298-2/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://usn.ubuntu.com/usn/usn-4298-2",
              "https://www.debian.org/security/2020/dsa-4606"
            ],
            "Description": "Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-13753",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: mishandles certain SELECT statements with a nonexistent VIEW, leading to DoS",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19603",
              "https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13",
              "https://security.netapp.com/advisory/ntap-20191223-0001/",
              "https://usn.ubuntu.com/4394-1/",
              "https://usn.ubuntu.com/usn/usn-4394-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.sqlite.org/"
            ],
            "Description": "SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19603",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19645",
              "https://github.com/sqlite/sqlite/commit/38096961c7cd109110ac21d3ed7dad7e0cb0ae06",
              "https://security.netapp.com/advisory/ntap-20191223-0001/",
              "https://usn.ubuntu.com/4394-1/",
              "https://usn.ubuntu.com/usn/usn-4394-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19645",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: invalid pointer dereference in exprListAppendList in window.c",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html",
              "https://access.redhat.com/errata/RHSA-2020:0514",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19880",
              "https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54",
              "https://security.netapp.com/advisory/ntap-20200114-0001/",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://www.debian.org/security/2020/dsa-4638",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19880",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 5.3,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: incorrect sqlite3WindowRewrite() error handling leads to mishandling certain parser-tree rewriting",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-19924.html",
              "http://linux.oracle.com/errata/ELSA-2020-1810.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19924",
              "https://github.com/sqlite/sqlite/commit/8654186b0236d556aa85528c2573ee0b6ab71be3",
              "https://security.netapp.com/advisory/ntap-20200114-0003/",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19924",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20218",
              "https://github.com/sqlite/sqlite/commit/a6c1a71cde082e09750465d5675699062922e387",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html",
              "https://security.gentoo.org/glsa/202007-26",
              "https://usn.ubuntu.com/4298-1/",
              "https://usn.ubuntu.com/usn/usn-4298-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20218",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: heap out-of-bound read in function rtreenode()",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-8457.html",
              "http://linux.oracle.com/errata/ELSA-2020-1810.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8457",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/",
              "https://security.netapp.com/advisory/ntap-20190606-0002/",
              "https://usn.ubuntu.com/4004-1/",
              "https://usn.ubuntu.com/4004-2/",
              "https://usn.ubuntu.com/4019-1/",
              "https://usn.ubuntu.com/4019-2/",
              "https://usn.ubuntu.com/usn/usn-4004-1",
              "https://usn.ubuntu.com/usn/usn-4004-2",
              "https://usn.ubuntu.com/usn/usn-4019-1",
              "https://usn.ubuntu.com/usn/usn-4019-2",
              "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "https://www.oracle.com/security-alerts/cpujan2020.html",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
              "https://www.sqlite.org/releaselog/3_28_0.html",
              "https://www.sqlite.org/src/info/90acdbfce9c08858"
            ],
            "Description": "SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-8457",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: NULL pointer dereference leads to segmentation fault in sqlite3ExprCodeTarget in expr.c",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13435",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/",
              "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc",
              "https://security.gentoo.org/glsa/202007-26",
              "https://security.netapp.com/advisory/ntap-20200528-0004/",
              "https://usn.ubuntu.com/4394-1/",
              "https://usn.ubuntu.com/usn/usn-4394-1",
              "https://www.oracle.com/security-alerts/cpujul2020.html",
              "https://www.sqlite.org/src/info/7a5279a25c57adf1"
            ],
            "Description": "SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-13435",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: virtual table can be renamed into the name of one of its shadow tables",
            "PkgName": "sqlite",
            "Severity": "MEDIUM",
            "References": [
              "https://bugs.chromium.org/p/chromium/issues/detail?id=1080459",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13631",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7KXQWHIY2MQP4LNM6ODWJENMXYYQYBN/",
              "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc",
              "https://security.gentoo.org/glsa/202007-26",
              "https://security.netapp.com/advisory/ntap-20200608-0002/",
              "https://sqlite.org/src/info/eca0ba2cf4c0fdf7",
              "https://usn.ubuntu.com/4394-1/",
              "https://usn.ubuntu.com/usn/usn-4394-1",
              "https://www.oracle.com/security-alerts/cpujul2020.html"
            ],
            "Description": "SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-13631",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 5.9,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V2Score": 1.2,
                "V3Score": 2.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: Tempdir selection vulnerability",
            "PkgName": "sqlite",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2016-08/msg00053.html",
              "http://www.openwall.com/lists/oss-security/2016/07/01/1",
              "http://www.openwall.com/lists/oss-security/2016/07/01/2",
              "http://www.securityfocus.com/bid/91546",
              "http://www.sqlite.org/cgi/src/info/67985761aa93fb61",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6153",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGQTH7V45QVHFDXJAEECHEO3HHD644WZ/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/",
              "https://usn.ubuntu.com/4019-1/",
              "https://usn.ubuntu.com/4019-2/",
              "https://usn.ubuntu.com/usn/usn-4019-1",
              "https://usn.ubuntu.com/usn/usn-4019-2",
              "https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt",
              "https://www.sqlite.org/releaselog/3_13_0.html",
              "https://www.tenable.com/security/tns-2016-20"
            ],
            "Description": "os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6153",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.6,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: Heap-buffer overflow in the getNodeSize function",
            "PkgName": "sqlite",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html",
              "http://marc.info/?l=sqlite-users&m=149933696214713&w=2",
              "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
              "http://www.securityfocus.com/bid/99502",
              "http://www.securitytracker.com/id/1039427",
              "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405",
              "https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10989",
              "https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html",
              "https://sqlite.org/src/info/66de6f4a",
              "https://sqlite.org/src/vpatch?from=0db20efe201736b3&to=66de6f4a9504ec26",
              "https://support.apple.com/HT208112",
              "https://support.apple.com/HT208113",
              "https://support.apple.com/HT208115",
              "https://support.apple.com/HT208144",
              "https://usn.ubuntu.com/4019-1/",
              "https://usn.ubuntu.com/4019-2/",
              "https://usn.ubuntu.com/usn/usn-4019-1",
              "https://usn.ubuntu.com/usn/usn-4019-2"
            ],
            "Description": "The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-10989",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.3,
                "V3Score": 5.5,
                "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: Local DoS via dump_callback function",
            "PkgName": "sqlite",
            "Severity": "LOW",
            "References": [
              "http://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg105314.html",
              "http://www.securityfocus.com/bid/100521",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13685",
              "https://usn.ubuntu.com/4019-1/",
              "https://usn.ubuntu.com/4019-2/",
              "https://usn.ubuntu.com/usn/usn-4019-1",
              "https://usn.ubuntu.com/usn/usn-4019-2"
            ],
            "Description": "The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-13685",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: NULL pointer dereference in tableColumnList",
            "PkgName": "sqlite",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/101285",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15286",
              "https://github.com/Ha0Team/crash-of-sqlite3/blob/master/poc.md"
            ],
            "Description": "SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-15286",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: NULL pointer dereference with databases with schema corrupted with CREATE TABLE AS allows for denial of service",
            "PkgName": "sqlite",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html",
              "http://www.securityfocus.com/bid/103466",
              "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6964",
              "https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1756349",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8740",
              "https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html",
              "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/",
              "https://usn.ubuntu.com/4205-1/",
              "https://usn.ubuntu.com/4394-1/",
              "https://usn.ubuntu.com/usn/usn-4205-1",
              "https://usn.ubuntu.com/usn/usn-4394-1",
              "https://www.sqlite.org/cgi/src/timeline?r=corrupt-schema",
              "https://www.sqlite.org/cgi/src/vdiff?from=1774f1c3baf0bc3d&to=d75e67654aa9620b"
            ],
            "Description": "In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-8740",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "sqlite: allows a crash if a sub-select uses both DISTINCT and window functions and also has certain ORDER BY usage",
            "PkgName": "sqlite",
            "Severity": "LOW",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19244",
              "https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348",
              "https://usn.ubuntu.com/4205-1/",
              "https://usn.ubuntu.com/usn/usn-4205-1",
              "https://www.oracle.com/security-alerts/cpuapr2020.html"
            ],
            "Description": "sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19244",
            "InstalledVersion": "3.7.17-8.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 9,
                "V3Score": 8.8,
                "V2Vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword",
            "PkgName": "sudo",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-14287.html",
              "http://linux.oracle.com/errata/ELSA-2019-4822.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.html",
              "http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html",
              "http://www.openwall.com/lists/oss-security/2019/10/14/1",
              "http://www.openwall.com/lists/oss-security/2019/10/24/1",
              "http://www.openwall.com/lists/oss-security/2019/10/29/3",
              "https://access.redhat.com/errata/RHBA-2019:3248",
              "https://access.redhat.com/errata/RHSA-2019:3197",
              "https://access.redhat.com/errata/RHSA-2019:3204",
              "https://access.redhat.com/errata/RHSA-2019:3205",
              "https://access.redhat.com/errata/RHSA-2019:3209",
              "https://access.redhat.com/errata/RHSA-2019:3219",
              "https://access.redhat.com/errata/RHSA-2019:3278",
              "https://access.redhat.com/errata/RHSA-2019:3694",
              "https://access.redhat.com/errata/RHSA-2019:3754",
              "https://access.redhat.com/errata/RHSA-2019:3755",
              "https://access.redhat.com/errata/RHSA-2019:3895",
              "https://access.redhat.com/errata/RHSA-2019:3916",
              "https://access.redhat.com/errata/RHSA-2019:3941",
              "https://access.redhat.com/errata/RHSA-2019:4191",
              "https://access.redhat.com/errata/RHSA-2020:0388",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14287",
              "https://lists.debian.org/debian-lts-announce/2019/10/msg00022.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/",
              "https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287",
              "https://seclists.org/bugtraq/2019/Oct/20",
              "https://seclists.org/bugtraq/2019/Oct/21",
              "https://security.gentoo.org/glsa/202003-12",
              "https://security.netapp.com/advisory/ntap-20191017-0003/",
              "https://support.f5.com/csp/article/K53746212?utm_source=f5support&amp;utm_medium=RSS",
              "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us",
              "https://usn.ubuntu.com/4154-1/",
              "https://usn.ubuntu.com/usn/usn-4154-1",
              "https://www.debian.org/security/2019/dsa-4543",
              "https://www.openwall.com/lists/oss-security/2019/10/15/2",
              "https://www.sudo.ws/alerts/minus_1_uid.html"
            ],
            "Description": "In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a \"sudo -u \\#$((0xffffffff))\" command.",
            "FixedVersion": "1.8.23-4.el7_7.1",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-14287",
            "InstalledVersion": "1.8.23-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7.8,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: Stack based buffer overflow when pwfeedback is enabled",
            "PkgName": "sudo",
            "Severity": "HIGH",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-18634.html",
              "http://linux.oracle.com/errata/ELSA-2020-0726.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.html",
              "http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html",
              "http://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.html",
              "http://seclists.org/fulldisclosure/2020/Jan/40",
              "http://www.openwall.com/lists/oss-security/2020/01/30/6",
              "http://www.openwall.com/lists/oss-security/2020/01/31/1",
              "http://www.openwall.com/lists/oss-security/2020/02/05/2",
              "http://www.openwall.com/lists/oss-security/2020/02/05/5",
              "https://access.redhat.com/errata/RHSA-2020:0487",
              "https://access.redhat.com/errata/RHSA-2020:0509",
              "https://access.redhat.com/errata/RHSA-2020:0540",
              "https://access.redhat.com/errata/RHSA-2020:0726",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18634",
              "https://lists.debian.org/debian-lts-announce/2020/02/msg00002.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/",
              "https://seclists.org/bugtraq/2020/Feb/2",
              "https://seclists.org/bugtraq/2020/Feb/3",
              "https://seclists.org/bugtraq/2020/Jan/44",
              "https://security.gentoo.org/glsa/202003-12",
              "https://security.netapp.com/advisory/ntap-20200210-0001/",
              "https://support.apple.com/kb/HT210919",
              "https://usn.ubuntu.com/4263-1/",
              "https://usn.ubuntu.com/4263-2/",
              "https://usn.ubuntu.com/usn/usn-4263-1",
              "https://usn.ubuntu.com/usn/usn-4263-2",
              "https://www.debian.org/security/2020/dsa-4614",
              "https://www.openwall.com/lists/oss-security/2020/01/30/6",
              "https://www.openwall.com/lists/oss-security/2020/01/31/1",
              "https://www.sudo.ws/alerts/pwfeedback.html",
              "https://www.sudo.ws/security.html"
            ],
            "Description": "In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c.",
            "FixedVersion": "1.8.23-4.el7_7.2",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-18634",
            "InstalledVersion": "1.8.23-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
              },
              "redhat": {
                "V2Score": 6.8,
                "V2Vector": "AV:N/AC:H/Au:S/C:C/I:C/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: Unauthorized privilege escalation in sudoedit",
            "PkgName": "sudo",
            "Severity": "MEDIUM",
            "References": [
              "http://bugzilla.sudo.ws/show_bug.cgi?id=707",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171024.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171054.html",
              "http://www.debian.org/security/2016/dsa-3440",
              "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "http://www.securitytracker.com/id/1034392",
              "http://www.sudo.ws/stable.html#1.8.15",
              "https://security.gentoo.org/glsa/201606-13",
              "https://www.exploit-db.com/exploits/37710/"
            ],
            "Description": "sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by \"/home/*/*/file.txt.\"",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5602",
            "InstalledVersion": "1.8.23-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.9,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6,
                "V2Vector": "AV:L/AC:H/Au:S/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: Race condition when checking digests in sudoers",
            "PkgName": "sudo",
            "Severity": "MEDIUM",
            "References": [
              "http://www.openwall.com/lists/oss-security/2015/11/18/22",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1283635",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8239",
              "https://www.sudo.ws/repos/sudo/rev/0cd3cc8fa195",
              "https://www.sudo.ws/repos/sudo/rev/24a3d9215c64",
              "https://www.sudo.ws/repos/sudo/rev/397722cdd7ec"
            ],
            "Description": "The SHA-2 digest support in the sudoers plugin in sudo after 1.8.7 allows local users with write permissions to parts of the called command to replace them before it is executed.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-8239",
            "InstalledVersion": "1.8.23-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user",
            "PkgName": "sudo",
            "Severity": "MEDIUM",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-19232.html",
              "http://linux.oracle.com/errata/ELSA-2020-1804.html",
              "http://seclists.org/fulldisclosure/2020/Mar/31",
              "https://access.redhat.com/security/cve/cve-2019-19232",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19232",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58103",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs76870",
              "https://security.netapp.com/advisory/ntap-20200103-0004/",
              "https://support.apple.com/en-gb/HT211100",
              "https://support.apple.com/kb/HT211100",
              "https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19232",
              "https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5506",
              "https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html",
              "https://www.oracle.com/security-alerts/bulletinapr2020.html",
              "https://www.sudo.ws/devel.html#1.8.30b2",
              "https://www.sudo.ws/stable.html",
              "https://www.sudo.ws/stable.html#1.8.30",
              "https://www.tenable.com/plugins/nessus/133936"
            ],
            "Description": "** DISPUTED ** In Sudo through 1.8.29, an attacker with access to a Runas ALL sudoer account can impersonate a nonexistent user by invoking sudo with a numeric uid that is not associated with any user. NOTE: The software maintainer believes that this is not a vulnerability because running a command via sudo as a user not present in the local password database is an intentional feature. Because this behavior surprised some users, sudo 1.8.30 introduced an option to enable/disable this behavior with the default being disabled. However, this does not change the fact that sudo was behaving as intended, and as documented, in earlier versions.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19232",
            "InstalledVersion": "1.8.23-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V3Score": 7.5,
                "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "sudo: by using ! character in the shadow file instead of a password hash can access to a run as all sudoer account",
            "PkgName": "sudo",
            "Severity": "MEDIUM",
            "References": [
              "https://access.redhat.com/security/cve/cve-2019-19234",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19234",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58104",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58473",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58772",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58812",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs58979",
              "https://quickview.cloudapps.cisco.com/quickview/bug/CSCvs60748",
              "https://security.netapp.com/advisory/ntap-20200103-0004/",
              "https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-19234",
              "https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1018-5505",
              "https://support2.windriver.com/index.php?page=defects&on=view&id=LIN1019-3816",
              "https://www.bsi.bund.de/SharedDocs/Warnmeldungen/DE/CB/2019/12/warnmeldung_cb-k20-0001.html",
              "https://www.oracle.com/security-alerts/bulletinapr2020.html",
              "https://www.sudo.ws/devel.html#1.8.30b2",
              "https://www.sudo.ws/stable.html",
              "https://www.sudo.ws/stable.html#1.8.30",
              "https://www.suse.com/security/cve/CVE-2019-19234/",
              "https://www.tenable.com/plugins/nessus/132985"
            ],
            "Description": "** DISPUTED ** In Sudo through 1.8.29, the fact that a user has been blocked (e.g., by using the ! character in the shadow file instead of a password hash) is not considered, allowing an attacker (who has access to a Runas ALL sudoer account) to impersonate any blocked user. NOTE: The software maintainer believes that this CVE is not valid. Disabling local password authentication for a user is not the same as disabling all access to that user--the user may still be able to login via other means (ssh key, kerberos, etc). Both the Linux shadow(5) and passwd(1) manuals are clear on this. Indeed it is a valid use case to have local accounts that are _only_ accessible via sudo and that cannot be logged into with a password. Sudo 1.8.30 added an optional setting to check the _shell_ of the target user (not the encrypted password!) against the contents of /etc/shells but that is not the same thing as preventing access to users with an invalid password hash.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-19234",
            "InstalledVersion": "1.8.23-4.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts",
            "PkgName": "systemd",
            "Severity": "MEDIUM",
            "References": [
              "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357",
              "http://www.openwall.com/lists/oss-security/2013/10/01/9",
              "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
            ],
            "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-4392",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Unsafe handling of hard links allowing privilege escalation",
            "PkgName": "systemd",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html",
              "http://packetstormsecurity.com/files/146184/systemd-Local-Privilege-Escalation.html",
              "http://www.openwall.com/lists/oss-security/2018/01/29/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18078",
              "https://github.com/systemd/systemd/issues/7736",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
              "https://www.exploit-db.com/exploits/43935/",
              "https://www.openwall.com/lists/oss-security/2018/01/29/4"
            ],
            "Description": "systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18078",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files",
            "PkgName": "systemd",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6954",
              "https://github.com/systemd/systemd/issues/7986",
              "https://usn.ubuntu.com/3816-1/",
              "https://usn.ubuntu.com/3816-2/",
              "https://usn.ubuntu.com/usn/usn-3816-1",
              "https://usn.ubuntu.com/usn/usn-3816-2"
            ],
            "Description": "systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6954",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Spoofing of XDG_SEAT allows for actions to be checked against \"allow_active\" instead of \"allow_any\"",
            "PkgName": "systemd",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html",
              "http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3842",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/",
              "https://usn.ubuntu.com/usn/usn-3938-1",
              "https://www.exploit-db.com/exploits/46743/"
            ],
            "Description": "In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-3842",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits",
            "PkgName": "systemd",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13776",
              "https://github.com/systemd/systemd/issues/15985",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/",
              "https://security.netapp.com/advisory/ntap-20200611-0003/"
            ],
            "Description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-13776",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.9,
                "V3Score": 4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "oci-register-machine: information exposure for docker containers",
            "PkgName": "systemd",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/07/26/9",
              "http://www.openwall.com/lists/oss-security/2016/10/13/7",
              "http://www.securityfocus.com/bid/92143",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1360634",
              "https://github.com/projectatomic/oci-register-machine/pull/22"
            ],
            "Description": "The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6349",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.4,
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received",
            "PkgName": "systemd",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-20386.html",
              "http://linux.oracle.com/errata/ELSA-2020-4007.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00014.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20386",
              "https://github.com/systemd/systemd/commit/b2774a3ae692113e1f47a336a6c09bac9cfb49ad",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZPCOMW5X6IZZXASCDD2CNW2DLF3YADC/",
              "https://security.netapp.com/advisory/ntap-20200210-0002/",
              "https://usn.ubuntu.com/4269-1/",
              "https://usn.ubuntu.com/usn/usn-4269-1"
            ],
            "Description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.",
            "FixedVersion": "219-78.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20386",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts",
            "PkgName": "systemd-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357",
              "http://www.openwall.com/lists/oss-security/2013/10/01/9",
              "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
            ],
            "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-4392",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Unsafe handling of hard links allowing privilege escalation",
            "PkgName": "systemd-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html",
              "http://packetstormsecurity.com/files/146184/systemd-Local-Privilege-Escalation.html",
              "http://www.openwall.com/lists/oss-security/2018/01/29/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18078",
              "https://github.com/systemd/systemd/issues/7736",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
              "https://www.exploit-db.com/exploits/43935/",
              "https://www.openwall.com/lists/oss-security/2018/01/29/4"
            ],
            "Description": "systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18078",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files",
            "PkgName": "systemd-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6954",
              "https://github.com/systemd/systemd/issues/7986",
              "https://usn.ubuntu.com/3816-1/",
              "https://usn.ubuntu.com/3816-2/",
              "https://usn.ubuntu.com/usn/usn-3816-1",
              "https://usn.ubuntu.com/usn/usn-3816-2"
            ],
            "Description": "systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6954",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Spoofing of XDG_SEAT allows for actions to be checked against \"allow_active\" instead of \"allow_any\"",
            "PkgName": "systemd-libs",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html",
              "http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3842",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/",
              "https://usn.ubuntu.com/usn/usn-3938-1",
              "https://www.exploit-db.com/exploits/46743/"
            ],
            "Description": "In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-3842",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits",
            "PkgName": "systemd-libs",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13776",
              "https://github.com/systemd/systemd/issues/15985",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/",
              "https://security.netapp.com/advisory/ntap-20200611-0003/"
            ],
            "Description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-13776",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.9,
                "V3Score": 4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "oci-register-machine: information exposure for docker containers",
            "PkgName": "systemd-libs",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/07/26/9",
              "http://www.openwall.com/lists/oss-security/2016/10/13/7",
              "http://www.securityfocus.com/bid/92143",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1360634",
              "https://github.com/projectatomic/oci-register-machine/pull/22"
            ],
            "Description": "The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6349",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.4,
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received",
            "PkgName": "systemd-libs",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-20386.html",
              "http://linux.oracle.com/errata/ELSA-2020-4007.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00014.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20386",
              "https://github.com/systemd/systemd/commit/b2774a3ae692113e1f47a336a6c09bac9cfb49ad",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZPCOMW5X6IZZXASCDD2CNW2DLF3YADC/",
              "https://security.netapp.com/advisory/ntap-20200210-0002/",
              "https://usn.ubuntu.com/4269-1/",
              "https://usn.ubuntu.com/usn/usn-4269-1"
            ],
            "Description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.",
            "FixedVersion": "219-78.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20386",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              },
              "redhat": {
                "V2Score": 3.3,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: TOCTOU race condition when updating file permissions and SELinux security contexts",
            "PkgName": "systemd-sysv",
            "Severity": "MEDIUM",
            "References": [
              "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357",
              "http://www.openwall.com/lists/oss-security/2013/10/01/9",
              "https://bugzilla.redhat.com/show_bug.cgi?id=859060"
            ],
            "Description": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2013-4392",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Unsafe handling of hard links allowing privilege escalation",
            "PkgName": "systemd-sysv",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html",
              "http://packetstormsecurity.com/files/146184/systemd-Local-Privilege-Escalation.html",
              "http://www.openwall.com/lists/oss-security/2018/01/29/3",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18078",
              "https://github.com/systemd/systemd/issues/7736",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
              "https://www.exploit-db.com/exploits/43935/",
              "https://www.openwall.com/lists/oss-security/2018/01/29/4"
            ],
            "Description": "systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-18078",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 7,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Mishandled symlinks in systemd-tmpfiles allows local users to obtain ownership of arbitrary files",
            "PkgName": "systemd-sysv",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6954",
              "https://github.com/systemd/systemd/issues/7986",
              "https://usn.ubuntu.com/3816-1/",
              "https://usn.ubuntu.com/3816-2/",
              "https://usn.ubuntu.com/usn/usn-3816-1",
              "https://usn.ubuntu.com/usn/usn-3816-2"
            ],
            "Description": "systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-6954",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.4,
                "V3Score": 7,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 4.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: Spoofing of XDG_SEAT allows for actions to be checked against \"allow_active\" instead of \"allow_any\"",
            "PkgName": "systemd-sysv",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html",
              "http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3842",
              "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC/",
              "https://usn.ubuntu.com/usn/usn-3938-1",
              "https://www.exploit-db.com/exploits/46743/"
            ],
            "Description": "In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-3842",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.2,
                "V3Score": 6.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 6.7,
                "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits",
            "PkgName": "systemd-sysv",
            "Severity": "MEDIUM",
            "References": [
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13776",
              "https://github.com/systemd/systemd/issues/15985",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/",
              "https://security.netapp.com/advisory/ntap-20200611-0003/"
            ],
            "Description": "systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2020-13776",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 3.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
              },
              "redhat": {
                "V2Score": 1.9,
                "V3Score": 4,
                "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "oci-register-machine: information exposure for docker containers",
            "PkgName": "systemd-sysv",
            "Severity": "LOW",
            "References": [
              "http://www.openwall.com/lists/oss-security/2016/07/26/9",
              "http://www.openwall.com/lists/oss-security/2016/10/13/7",
              "http://www.securityfocus.com/bid/92143",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1360634",
              "https://github.com/projectatomic/oci-register-machine/pull/22"
            ],
            "Description": "The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6349",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 2.4,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              },
              "redhat": {
                "V3Score": 2.4,
                "V3Vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "systemd: memory leak in button_open() in login/logind-button.c when udev events are received",
            "PkgName": "systemd-sysv",
            "Severity": "LOW",
            "References": [
              "http://linux.oracle.com/cve/CVE-2019-20386.html",
              "http://linux.oracle.com/errata/ELSA-2020-4007.html",
              "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00014.html",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20386",
              "https://github.com/systemd/systemd/commit/b2774a3ae692113e1f47a336a6c09bac9cfb49ad",
              "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZPCOMW5X6IZZXASCDD2CNW2DLF3YADC/",
              "https://security.netapp.com/advisory/ntap-20200210-0002/",
              "https://usn.ubuntu.com/4269-1/",
              "https://usn.ubuntu.com/usn/usn-4269-1"
            ],
            "Description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.",
            "FixedVersion": "219-78.el7",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20386",
            "InstalledVersion": "219-67.el7_7.1"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
              },
              "redhat": {
                "V2Score": 5.1,
                "V2Vector": "AV:N/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "tar: Bypassing the extract path name",
            "PkgName": "tar",
            "Severity": "MEDIUM",
            "References": [
              "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d",
              "http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html",
              "http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html",
              "http://seclists.org/fulldisclosure/2016/Oct/102",
              "http://seclists.org/fulldisclosure/2016/Oct/96",
              "http://www.debian.org/security/2016/dsa-3702",
              "http://www.securityfocus.com/bid/93937",
              "http://www.ubuntu.com/usn/USN-3132-1",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6321",
              "https://security.gentoo.org/glsa/201611-19",
              "https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt",
              "https://sintonen.fi/advisories/tar-extract-pathname-bypass.txt",
              "https://usn.ubuntu.com/usn/usn-3132-1"
            ],
            "Description": "Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-6321",
            "InstalledVersion": "2:1.26-35.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 1.9,
                "V3Score": 4.7,
                "V2Vector": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "tar: Infinite read loop in sparse_dump_region function in sparse.c",
            "PkgName": "tar",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454",
              "http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html",
              "http://www.securityfocus.com/bid/106354",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20482",
              "https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html",
              "https://news.ycombinator.com/item?id=18745431",
              "https://security.gentoo.org/glsa/201903-05",
              "https://twitter.com/thatcks/status/1076166645708668928",
              "https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug"
            ],
            "Description": "GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2018-20482",
            "InstalledVersion": "2:1.26-35.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 5,
                "V3Score": 7.5,
                "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:877b494a9f30e74e61b441ed84bb74b14e66fb9cc321d83f3a8a19c60d078654",
              "Digest": "sha256:d8d02d45731499028db01b6fa35475f91d230628b4e25fab8e3c015594dc3261"
            },
            "Title": "tar: null-pointer dereference in pax_decode_header in sparse.c",
            "PkgName": "tar",
            "Severity": "LOW",
            "References": [
              "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120",
              "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html",
              "http://savannah.gnu.org/bugs/?55369",
              "https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923"
            ],
            "Description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-9923",
            "InstalledVersion": "2:1.26-35.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: command injection flaw in blkid",
            "PkgName": "util-linux",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html",
              "http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html",
              "http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html",
              "http://www.openwall.com/lists/oss-security/2014/11/26/21",
              "http://www.securityfocus.com/bid/71327",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1168485",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9114",
              "https://exchange.xforce.ibmcloud.com/vulnerabilities/98993",
              "https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc",
              "https://security.gentoo.org/glsa/201612-14"
            ],
            "Description": "Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2014-9114",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.2,
                "V3Score": 7.8,
                "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V2Score": 6.2,
                "V3Score": 8.6,
                "V2Vector": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "util-linux: runuser tty hijack via TIOCSTI ioctl",
            "PkgName": "util-linux",
            "Severity": "MEDIUM",
            "References": [
              "http://marc.info/?l=util-linux-ng&m=145694736107128&w=2",
              "http://www.openwall.com/lists/oss-security/2016/02/27/1",
              "http://www.openwall.com/lists/oss-security/2016/02/27/2",
              "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2779"
            ],
            "Description": "runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2016-2779",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
              },
              "redhat": {
                "V2Score": 3.7,
                "V2Vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "colcrt: global-buffer-overflow",
            "PkgName": "util-linux",
            "Severity": "LOW",
            "References": [
              "http://lists.opensuse.org/opensuse-updates/2015-11/msg00035.html",
              "http://www.spinics.net/lists/util-linux-ng/msg11873.html",
              "https://bugzilla.redhat.com/show_bug.cgi?id=1259322",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5218",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8",
              "https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec",
              "https://www.kernel.org/pub/linux/utils/util-linux/v2.27/v2.27-ReleaseNotes"
            ],
            "Description": "Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2015-5218",
            "InstalledVersion": "2.23.2-61.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 4.6,
                "V3Score": 5.3,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              },
              "redhat": {
                "V3Score": 5.3,
                "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode",
            "PkgName": "vim-minimal",
            "Severity": "MEDIUM",
            "References": [
              "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00018.html",
              "http://seclists.org/fulldisclosure/2020/Jul/24",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20807",
              "https://github.com/vim/vim/commit/8c62a08faf89663e5633dc5036cd8695c80f1075",
              "https://github.com/vim/vim/releases/tag/v8.1.0881",
              "https://support.apple.com/kb/HT211289"
            ],
            "Description": "In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2019-20807",
            "InstalledVersion": "2:7.4.629-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "vim: Ignores umask when creating a swap file",
            "PkgName": "vim-minimal",
            "Severity": "LOW",
            "References": [
              "http://security.cucumberlinux.com/security/details.php?id=120",
              "http://www.openwall.com/lists/oss-security/2017/10/31/1"
            ],
            "Description": "VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file (\"[ORIGINAL_FILENAME].swp\") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-1000382",
            "InstalledVersion": "2:7.4.629-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 6.8,
                "V3Score": 7.8,
                "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 3.3,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "vim: Use-after-free via crafted file",
            "PkgName": "vim-minimal",
            "Severity": "LOW",
            "References": [
              "https://bugzilla.redhat.com/show_bug.cgi?id=1468492",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11109",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html",
              "https://usn.ubuntu.com/4309-1/",
              "https://usn.ubuntu.com/usn/usn-4309-1",
              "https://www.mail-archive.com/vim_dev@googlegroups.com/msg45274.html"
            ],
            "Description": "Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. NOTE: there might be a limited number of scenarios in which this has security relevance.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-11109",
            "InstalledVersion": "2:7.4.629-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 2.1,
                "V3Score": 5.5,
                "V2Vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              },
              "redhat": {
                "V3Score": 5.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "vim: Sets the group ownership of a .swp file to the editor's primary group",
            "PkgName": "vim-minimal",
            "Severity": "LOW",
            "References": [
              "http://openwall.com/lists/oss-security/2017/11/27/2",
              "http://security.cucumberlinux.com/security/details.php?id=166",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17087",
              "https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8",
              "https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ",
              "https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html"
            ],
            "Description": "fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-17087",
            "InstalledVersion": "2:7.4.629-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 2.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "vim: Tree length values not validated properly when handling a spell file",
            "PkgName": "vim-minimal",
            "Severity": "LOW",
            "References": [
              "http://www.debian.org/security/2017/dsa-3786",
              "http://www.securityfocus.com/bid/96217",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5953",
              "https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d",
              "https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY",
              "https://security.gentoo.org/glsa/201706-26",
              "https://usn.ubuntu.com/4016-1/",
              "https://usn.ubuntu.com/4309-1/",
              "https://usn.ubuntu.com/usn/usn-4016-1",
              "https://usn.ubuntu.com/usn/usn-4309-1"
            ],
            "Description": "vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-5953",
            "InstalledVersion": "2:7.4.629-6.el7"
          },
          {
            "CVSS": {
              "nvd": {
                "V2Score": 7.5,
                "V3Score": 9.8,
                "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              "redhat": {
                "V3Score": 2.5,
                "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
              }
            },
            "Layer": {
              "DiffID": "sha256:662009dcc4193ef33f9b4b4f8f158c8a0ce2b0f019ef8ad12b108e1659e949dc",
              "Digest": "sha256:58b827811b460cc81672b1baf09b8188971ccd7a551fc6d95446ffc63bec449f"
            },
            "Title": "vim: Integer overflow at an unserialize_uep memory allocation site",
            "PkgName": "vim-minimal",
            "Severity": "LOW",
            "References": [
              "http://www.securityfocus.com/bid/96448",
              "http://www.securitytracker.com/id/1037949",
              "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6350",
              "https://github.com/vim/vim/commit/0c8485f0e4931463c0f7986e1ea84a7d79f10c75",
              "https://groups.google.com/forum/#!topic/vim_dev/L_dOHOOiQ5Q",
              "https://groups.google.com/forum/#!topic/vim_dev/QPZc0CY9j3Y",
              "https://security.gentoo.org/glsa/201706-26",
              "https://usn.ubuntu.com/4309-1/",
              "https://usn.ubuntu.com/usn/usn-4309-1"
            ],
            "Description": "An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.",
            "SeveritySource": "redhat",
            "VulnerabilityID": "CVE-2017-6350",
            "InstalledVersion": "2:7.4.629-6.el7"
          }
        ]
      }
    ]
  }
}
