huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Linux kernel: Denial of Service via out-of-bounds read in EDAC/skx_common module reload
CVE: CVE-2025-38298
Component: kernel
CWE: CWE-909
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

EDAC/skx_common: Fix general protection fault

After loading i10nm_edac (which automatically loads skx_edac_common), if
unload only i10nm_edac, then reload it and perform error injection testing,
a general protection fault may occur:

  mce: [Hardware Error]: Machine check events logged
  Oops: general protection fault ...
  ...
  Workqueue: events mce_gen_pool_process
  RIP: 0010:string+0x53/0xe0
  ...
  Call Trace:
  <TASK>
  ? die_addr+0x37/0x90
  ? exc_general_protection+0x1e7/0x3f0
  ? asm_exc_general_protection+0x26/0x30
  ? string+0x53/0xe0
  vsnprintf+0x23e/0x4c0
  snprintf+0x4d/0x70
  skx_adxl_decode+0x16a/0x330 [skx_edac_common]
  skx_mce_check_error.part.0+0xf8/0x220 [skx_edac_common]
  skx_mce_check_error+0x17/0x20 [skx_edac_common]
  ...

The issue arose was because the variable 'adxl_component_count' (inside
skx_edac_common), which counts the ADXL components, was not reset. During
the reloading of i10nm_edac, the count was incremented by the actual number
of ADXL components again, resulting in a count that was double the real
number of ADXL components. This led to an out-of-bounds reference to the
ADXL component array, causing the general protection fault above.

Fix this issue by resetting the 'adxl_component_count' in adxl_put(),
which is called during the unloading of {skx,i10nm}_edac.


Remediation:
MySQL Server: Denial of Service via network access
CVE: CVE-2025-21543
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:53:13.601000+00:00

A flaw was found in MySQL Server. This vulnerability allows unauthorized remote attacker to cause a denial of service (DoS).


Remediation:
thunderbird: XSLT documents could bypass CSP
CVE: CVE-2025-8032
Component: firefox
CWE: CWE-693
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-07-22T20:49:26.507000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
XSLT document loading incorrectly propagates the source document which bypassed its CSP.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
functionfs: fix the open/removal races
CVE: CVE-2025-71074
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

functionfs: fix the open/removal races

ffs_epfile_open() can race with removal, ending up with file->private_data
pointing to freed object.

There is a total count of opened files on functionfs (both ep0 and
dynamic ones) and when it hits zero, dynamic files get removed.
Unfortunately, that removal can happen while another thread is
in ffs_epfile_open(), but has not incremented the count yet.
In that case open will succeed, leaving us with UAF on any subsequent
read() or write().

The root cause is that ffs->opened is misused; atomic_dec_and_test() vs.
atomic_add_return() is not a good idea, when object remains visible all
along.

To untangle that
	* serialize openers on ffs->mutex (both for ep0 and for dynamic files)
	* have dynamic ones use atomic_inc_not_zero() and fail if we had
zero ->opened; in that case the file we are opening is doomed.
	* have the inodes of dynamic files marked on removal (from the
callback of simple_recursive_removal()) - clear ->i_private there.
	* have open of dynamic ones verify they hadn't been already removed,
along with checking that state is FFS_ACTIVE.


Remediation:
git script execution flaw
CVE: CVE-2025-27614
Component: gitk
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-07-08T13:01:00+00:00

There's a vulnerability in gitk where an user can be tricked to run malicious scripts supplied by the attacker when running gitk filename command. When successfully exploited this vulnerability may result in arbitrary code execution.

Statement: The Red Hat Product Security team has rated this vulnerability as having a Moderate impact as it depends on the user to be tricked to run the command using the malicious file as parameter.

Remediation:
There's no known mitigation for this issue besides avoid using gitk with untrusted repositories or unstrusted files.
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
CVE: CVE-2025-68255
Component: kernel
Severity: Moderate
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

The Supported Rates IE length from an incoming Association Request frame
was used directly as the memcpy() length when copying into a fixed-size
16-byte stack buffer (supportRate). A malicious station can advertise an
IE length larger than 16 bytes, causing a stack buffer overflow.

Clamp ie_len to the buffer size before copying the Supported Rates IE,
and correct the bounds check when merging Extended Supported Rates to
prevent a second potential overflow.

This prevents kernel stack corruption triggered by malformed association
requests.


Remediation:
CVE: CVE-2025-15335
Component: Tanium addressed an information disclosure vulnerability in Threat Response.
Release date: 2025-09-16T00:00:00+00:00

Tanium addressed an information disclosure vulnerability in Threat Response.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
uprobes/x86: Harden uretprobe syscall trampoline check
CVE: CVE-2025-22046
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

uprobes/x86: Harden uretprobe syscall trampoline check

Jann reported a possible issue when trampoline_check_ip returns
address near the bottom of the address space that is allowed to
call into the syscall if uretprobes are not set up:

   https://lore.kernel.org/bpf/202502081235.5A6F352985@keescook/T/#m9d416df341b8fbc11737dacbcd29f0054413cbbf

Though the mmap minimum address restrictions will typically prevent
creating mappings there, let's make sure uretprobe syscall checks
for that.


Remediation:
libcoap: Remote code execution or Denial of Service via stack-based buffer overflow in address resolution
CVE: CVE-2025-34468
Component: libcoap
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-31T18:39:07.530000+00:00

A flaw was found in libcoap. A remote attacker can exploit a stack-based buffer overflow vulnerability in the address resolution function. This occurs when attacker-controlled hostname data is copied into a fixed-size buffer without proper validation. This can lead to a crash, resulting in a Denial of Service (DoS), and depending on system configurations, could potentially enable remote code execution. Exploitation requires the proxy logic to be enabled in an application using libcoap.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
\htmlData does not validate attribute names in KaTeX
CVE: CVE-2025-23207
Component: katex
CWE: CWE-116
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-01-17T21:25:05.746000+00:00

A flaw was found in the KaTeX library. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript or generate invalid HTML.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Users unable to upgrade should turn off the `trust` option or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.
chromium: webkitgtk: Out of bounds memory access via crafted HTML page
CVE: CVE-2025-14174
Component: Google Chrome
CWE: CWE-823
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-12T19:20:41.809000+00:00

A flaw was found in ANGLE in Google Chrome. This vulnerability allows a remote attacker to perform out of bounds memory access via a crafted HTML (HyperText Markup Language) page. Although this was reported on Google Chrome, this issue also affected the WebKitGTK package with the same possible outcome.

Statement: This vulnerability is rated as Important by the Red Hat Product Security. A maliciously crafted web page may lead to out of bound memory access, specially in WebKitGTK component, and may be leverage to perform a remote code execution. For an attack be successfully performed, the user needs to be tricked to visit the malicious web page using the affected component.

Remediation:
x86/cpu: Avoid running off the end of an AMD erratum table
CVE: CVE-2025-37751
Component: kernel
CWE: CWE-805
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/cpu: Avoid running off the end of an AMD erratum table

The NULL array terminator at the end of erratum_1386_microcode was
removed during the switch from x86_cpu_desc to x86_cpu_id. This
causes readers to run off the end of the array.

Replace the NULL.


Remediation:
Optimizer unspecified vulnerability (CPU Oct 2025)
CVE: CVE-2025-53040
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-21T20:02:54.332000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
CVE: CVE-2025-5196
Component: Wing FTP Server Lua Admin Console unnecessary privileges
Release date: 2025-05-26T13:31:05.016000+00:00

A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Lua Admin Console. The manipulation leads to execution with unnecessary privileges. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 7.4.4 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[W]e do not consider it as a security vulnerability, because the system admin in WingFTP has full permissions [...], but you can suggest the user run WingFTP service as Normal User rather than SYSTEM/Root, it will be safer."

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Suricata: Stack Overflow Vulnerability via Large HTTP Content Type Logging
CVE: CVE-2025-64333
Component: Suricata
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-26T22:57:02.640000+00:00

A flaw was found in Suricata. This vulnerability allows a stack overflow, leading to a crash, via a large HTTP (Hypertext Transfer Protocol) content type when logged.

Statement: The vulnerability in Suricata allows a remote attacker to cause a denial of service by sending a crafted HTTP request with a large content type, leading to a stack overflow and application crash. The highest threat is to system availability.

Remediation:
Rust standard library didn't detect all path separators on Cygwin
CVE: CVE-2025-11233
Component: rust
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2025-10-01T16:49:50.139000+00:00

Starting from Rust 1.87.0 and before Rust 1.89.0, the tier 3 Cygwin target (`x86_64-pc-cygwin`) didn't correctly handle path separators, causing the standard library's Path API to ignore path components separated by backslashes. Due to this, programs compiled for Cygwin that validate paths could misbehave, potentially allowing path traversal attacks or malicious filesystem operations.




Rust 1.89.0 fixes the issue by handling both Win32 and Unix style paths in the standard library for the Cygwin target.



While we assess the severity of this vulnerability as "medium", please note that the tier 3 Cygwin compilation target is only available when building it from source: no pre-built binaries are distributed by the Rust project, and it cannot be installed through Rustup. Unless you manually compiled the `x86_64-pc-cygwin` target you are not affected by this vulnerability. Users of the tier 1 MinGW target (`x86_64-pc-windows-gnu`) are also explicitly not affected.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race
CVE: CVE-2025-21685
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race

The yt2_1380_fc_serdev_probe() function calls devm_serdev_device_open()
before setting the client ops via serdev_device_set_client_ops(). This
ordering can trigger a NULL pointer dereference in the serdev controller's
receive_buf handler, as it assumes serdev->ops is valid when
SERPORT_ACTIVE is set.

This is similar to the issue fixed in commit 5e700b384ec1
("platform/chrome: cros_ec_uart: properly fix race condition") where
devm_serdev_device_open() was called before fully initializing the
device.

Fix the race by ensuring client ops are set before enabling the port via
devm_serdev_device_open().

Note, serdev_device_set_baudrate() and serdev_device_set_flow_control()
calls should be after the devm_serdev_device_open() call.


Remediation:
Envoy: De-synchronized CONNECT tunnel state due to early data handling in TCP proxy mode
CVE: CVE-2025-64763
Component: Envoy
CWE: CWE-693
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-12-03T18:13:58.496000+00:00

A flaw was found in Envoy. This vulnerability allows a de-synchronized CONNECT tunnel state via accepting client data before issuing a 2xx response and forwarding it to the upstream TCP (Transmission Control Protocol) connection when configured in TCP (Transmission Control Protocol) proxy mode to handle CONNECT requests.

Statement: This vulnerability is rated Moderate for Red Hat. Envoy, when operating in TCP proxy mode for CONNECT requests, forwards client data before a 2xx response. This can lead to a de-synchronized CONNECT tunnel state if an upstream proxy rejects the tunnel establishment. This behavior is enabled by default in affected versions of OpenShift Service Mesh.

Remediation:
To mitigate this issue, set the `envoy.reloadable_features.reject_early_connect_data` runtime flag to reject CONNECT requests that send data before a 2xx response. This configuration change may require a service reload or restart to take effect.
CVE: CVE-2025-14932
Component: NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-12-18T21:21:13.419000+00:00

NSF Unidata NetCDF-C Time Unit Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NSF Unidata NetCDF-C. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of time units. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27273.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service due to deadlock in PCI error recovery
CVE: CVE-2025-68310
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could trigger a deadlock between the PCI (Peripheral Component Interconnect) error recovery mechanism and the mlx5 crdump functionality. This occurs due to an incorrect lock acquisition during PCI error recovery on s390 systems. The deadlock causes system tasks to become unresponsive, leading to a Denial of Service (DoS).


Remediation:
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
CVE: CVE-2025-71131
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's seqiv (Sequence IV) crypto module. After calling crypto_aead_encrypt(), the underlying request may be freed by asynchronous completion handlers. The code then incorrectly dereferences req->iv to compare against info, accessing potentially freed memory. This can cause memory corruption or crashes when using asynchronous AEAD encryption.

Statement: This vulnerability affects systems using the seqiv IV generator with asynchronous AEAD encryption algorithms. The race condition occurs when the encryption completes asynchronously before the calling code finishes examining the request structure. The use-after-free can cause kernel crashes or unpredictable behavior during cryptographic operations.

Remediation:
FontForge: Remote Code Execution via malicious SFD file parsing
CVE: CVE-2025-15270
Component: fontforge
CWE: CWE-129
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-31T06:58:49.796000+00:00

A flaw was found in FontForge. This vulnerability allows a remote attacker to execute arbitrary code by tricking a user into opening a specially crafted SFD (Spline Font Database) file. The issue stems from improper validation of array indexes during SFD file parsing, which can lead to writing data beyond the allocated memory boundary. Successful exploitation results in arbitrary code execution in the context of the current user.

Statement: This vulnerability is rated Important for Red Hat products as it allows remote code execution in FontForge. Exploitation requires user interaction, where a target must open a specially crafted SFD file. This affects systems where FontForge is installed and used to process untrusted font files.

Remediation:
To mitigate this issue, users should avoid opening untrusted SFD (Spline Font Database) files with FontForge. If FontForge is not required, consider removing the `fontforge` package to eliminate the attack surface.

To remove the package on Red Hat Enterprise Linux:
`sudo yum remove fontforge` (for RHEL 6/7)
`sudo dnf remove fontforge` (for RHEL 8/9/10 and Fedora)

Removing this package may impact functionality that relies on FontForge.
ima: Handle error code returned by ima_filter_rule_match()
CVE: CVE-2025-68740
Component: kernel
CWE: CWE-394
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ima: Handle error code returned by ima_filter_rule_match()

In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to
the rule being NULL, the function incorrectly skips the 'if (!rc)' check
and sets 'result = true'. The LSM rule is considered a match, causing
extra files to be measured by IMA.

This issue can be reproduced in the following scenario:
After unloading the SELinux policy module via 'semodule -d', if an IMA
measurement is triggered before ima_lsm_rules is updated,
in ima_match_rules(), the first call to ima_filter_rule_match() returns
-ESTALE. This causes the code to enter the 'if (rc == -ESTALE &&
!rule_reinitialized)' block, perform ima_lsm_copy_rule() and retry. In
ima_lsm_copy_rule(), since the SELinux module has been removed, the rule
becomes NULL, and the second call to ima_filter_rule_match() returns
-ENOENT. This bypasses the 'if (!rc)' check and results in a false match.

Call trace:
  selinux_audit_rule_match+0x310/0x3b8
  security_audit_rule_match+0x60/0xa0
  ima_match_rules+0x2e4/0x4a0
  ima_match_policy+0x9c/0x1e8
  ima_get_action+0x48/0x60
  process_measurement+0xf8/0xa98
  ima_bprm_check+0x98/0xd8
  security_bprm_check+0x5c/0x78
  search_binary_handler+0x6c/0x318
  exec_binprm+0x58/0x1b8
  bprm_execve+0xb8/0x130
  do_execveat_common.isra.0+0x1a8/0x258
  __arm64_sys_execve+0x48/0x68
  invoke_syscall+0x50/0x128
  el0_svc_common.constprop.0+0xc8/0xf0
  do_el0_svc+0x24/0x38
  el0_svc+0x44/0x200
  el0t_64_sync_handler+0x100/0x130
  el0t_64_sync+0x3c8/0x3d0

Fix this by changing 'if (!rc)' to 'if (rc <= 0)' to ensure that error
codes like -ENOENT do not bypass the check and accidentally result in a
successful match.


Remediation:
net: fix NULL pointer dereference in l3mdev_l3_rcv
CVE: CVE-2025-22103
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: fix NULL pointer dereference in l3mdev_l3_rcv

When delete l3s ipvlan:

    ip link del link eth0 ipvlan1 type ipvlan mode l3s

This may cause a null pointer dereference:

    Call trace:
     ip_rcv_finish+0x48/0xd0
     ip_rcv+0x5c/0x100
     __netif_receive_skb_one_core+0x64/0xb0
     __netif_receive_skb+0x20/0x80
     process_backlog+0xb4/0x204
     napi_poll+0xe8/0x294
     net_rx_action+0xd8/0x22c
     __do_softirq+0x12c/0x354

This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after
ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process
like this:

    (CPU1)                     | (CPU2)
    l3mdev_l3_rcv()            |
      check dev->priv_flags:   |
        master = skb->dev;     |
                               |
                               | ipvlan_l3s_unregister()
                               |   set dev->priv_flags
                               |   dev->l3mdev_ops = NULL;
                               |
      visit master->l3mdev_ops |

To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan.


Remediation: