huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
CVE: CVE-2025-13033
Component: nodemailer
CWE: CWE-1286
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-10-07T13:42:02+00:00

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Statement: This vulnerability allows an attacker to force nodemailer to send an email to an attacker-owned email address by leveraging the incorrect handling of quoted local-parts containing the '@' character in the destination email address. When successfully exploited, this vulnerability may allow an attacker to exfiltrate data by misrouting emails to an unintended domain, presenting a high impact on data confidentiality.

This vulnerability has been assessed as having a Moderate impact on Red Hat Products by the Red Hat Product Security team. This is because for an attacker successfully exploit this vulnerability, the malicious actor needs to have direct control over the destination email input.

Remediation:
For more about Red Hat Developer Hub, see References links
Currently there's no available mitigation for this flaw.
drm/tegra: Fix a possible null pointer dereference
CVE: CVE-2025-38363
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/tegra: Fix a possible null pointer dereference

In tegra_crtc_reset(), new memory is allocated with kzalloc(), but
no check is performed. Before calling __drm_atomic_helper_crtc_reset,
state should be checked to prevent possible null pointer dereference.

Statement: A NULL pointer dereference vulnerability was identified in the Tegra DRM subsystem. In `tegra_crtc_reset()`, the newly allocated state structure was not checked before being passed to `__drm_atomic_helper_crtc_reset()`, which could lead to a crash if allocation failed.

The kernel panic could happen, especially under memory pressure scenarios where `kzalloc()` can return NULL.

The affected function tegra_crtc_reset() is part of the DRM Tegra kernel driver and is only invoked within privileged kernel contexts, such as during device initialization or reset paths. Since this code path cannot be directly reached by unprivileged userspace without prior kernel-level execution, the Privileges Required metric is set to High.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Denial of Service in SQLite
CVE: CVE-2025-29088
Component: sqlite
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-10T00:00:00+00:00

A flaw was found in SQLite. This vulnerability allows an application-level denial of service via improper configuration of the lookaside memory allocator, which could lead to resource exhaustion or application crashes.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
scsi: bfa: Double-free fix
CVE: CVE-2025-38699
Component: kernel
CWE: CWE-415
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: bfa: Double-free fix

When the bfad_im_probe() function fails during initialization, the memory
pointed to by bfad->im is freed without setting bfad->im to NULL.

Subsequently, during driver uninstallation, when the state machine enters
the bfad_sm_stopping state and calls the bfad_im_probe_undo() function,
it attempts to free the memory pointed to by bfad->im again, thereby
triggering a double-free vulnerability.

Set bfad->im to NULL if probing fails.

Statement: A double-free bug in bfad_im_probe() could be triggered if probe fails: memory for bfad->im is released but the pointer is not cleared. During driver shutdown, bfad_im_probe_undo() frees it again, leading to a double free. Exploitation for privilege escalation is highly unlikely since this occurs only in the probe failure path and requires root privileges to load/unload the driver.

Remediation:
To mitigate this issue, prevent module bfa from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
perf: Avoid undefined behavior from stopping/starting inactive events
CVE: CVE-2025-39821
Component: kernel
CWE: CWE-1335
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-09-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf: Avoid undefined behavior from stopping/starting inactive events

Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can
leave event->hw.idx at -1. When PMU drivers later attempt to use this
negative index as a shift exponent in bitwise operations, it leads to UBSAN
shift-out-of-bounds reports.

The issue is a logical flaw in how event groups handle throttling when some
members are intentionally disabled. Based on the analysis and the
reproducer provided by Mark Rutland (this issue on both arm64 and x86-64).

The scenario unfolds as follows:

 1. A group leader event is configured with a very aggressive sampling
    period (e.g., sample_period = 1). This causes frequent interrupts and
    triggers the throttling mechanism.
 2. A child event in the same group is created in a disabled state
    (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF.
    Since it hasn't been scheduled onto the PMU, its event->hw.idx remains
    initialized at -1.
 3. When throttling occurs, perf_event_throttle_group() and later
    perf_event_unthrottle_group() iterate through all siblings, including
    the disabled child event.
 4. perf_event_throttle()/unthrottle() are called on this inactive child
    event, which then call event->pmu->start()/stop().
 5. The PMU driver receives the event with hw.idx == -1 and attempts to
    use it as a shift exponent. e.g., in macros like PMCNTENSET(idx),
    leading to the UBSAN report.

The throttling mechanism attempts to start/stop events that are not
actively scheduled on the hardware.

Move the state check into perf_event_throttle()/perf_event_unthrottle() so
that inactive events are skipped entirely. This ensures only active events
with a valid hw.idx are processed, preventing undefined behavior and
silencing UBSAN warnings. The corrected check ensures true before
proceeding with PMU operations.

The problem can be reproduced with the syzkaller reproducer:


Remediation:
Linux kernel: Denial of Service due to incorrect lowcore memory mapping
CVE: CVE-2025-38733
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/mm: Do not map lowcore with identity mapping

Since the identity mapping is pinned to address zero the lowcore is always
also mapped to address zero, this happens regardless of the relocate_lowcore
command line option. If the option is specified the lowcore is mapped
twice, instead of only once.

This means that NULL pointer accesses will succeed instead of causing an
exception (low address protection still applies, but covers only parts).
To fix this never map the first two pages of physical memory with the
identity mapping.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Skops OperatorFuncNode Code Execution Vulnerability
CVE: CVE-2025-54412
Component: skops
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-07-26T03:29:10.918000+00:00

A flaw was found in skops. An inconsistency in OperatorFuncNode can hide the execution of untrusted operator methods when a specially crafted model file is loaded. This issue allows arbitrary code execution at load time.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Open Asset Import Library Assimp LWOLoader.cpp CountVertsAndFacesLWO2 out-of-bounds
CVE: CVE-2025-5201
Component: assimp
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-26T19:00:09.982000+00:00

A fuzzer test discovered a heap based buffer overflow in the Open Asset Import Library Assimp on version 5.4.3. The LWOImporter::CountVertsAndFacesLWO2 function in the assimp/code/AssetLib/LWO/LWOLoader.cpp file is affected. The manipulation leads to out-of-bounds read, which can lead to an application crash. The attacker needs to be local in order to exploit this vulnerability.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
CVE: CVE-2025-40001
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: mvsas: Fix use-after-free bugs in mvs_work_queue

During the detaching of Marvell's SAS/SATA controller, the original code
calls cancel_delayed_work() in mvs_free() to cancel the delayed work
item mwq->work_q. However, if mwq->work_q is already running, the
cancel_delayed_work() may fail to cancel it. This can lead to
use-after-free scenarios where mvs_free() frees the mvs_info while
mvs_work_queue() is still executing and attempts to access the
already-freed mvs_info.

A typical race condition is illustrated below:

CPU 0 (remove)            | CPU 1 (delayed work callback)
mvs_pci_remove()          |
  mvs_free()              | mvs_work_queue()
    cancel_delayed_work() |
      kfree(mvi)          |
                          |   mvi-> // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the delayed work item is properly canceled and any executing
delayed work item completes before the mvs_info is deallocated.

This bug was found by static analysis.

Statement: The patch fixes a use-after-free in the Marvell mvsas driver during device detach: the driver used cancel_delayed_work() instead of the synchronous variant, so a running delayed work (mvs_work_queue) could continue after mvs_info had been freed. Impact is a reliable kernel crash/DoS (and theoretically harder-to-exploit memory corruption) when a device is removed while the work is pending. This can be reproduced by hot-unplug/PCI reset or module removal on systems using the mvsas HBA while its delayed work is active. For the CVSS the PR:H, because requires local access and a specific hardware/driver configuration, typically with admin-level ability to trigger device removal.

Remediation:
OOB Read on libsoup through function  "soup_multipart_new_from_message" in soup-multipart.c leads to crash or  exit of process
CVE: CVE-2025-32914
Component: libsoup
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-04-14T00:00:00+00:00

A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.


Remediation:
Currently, no mitigation is available for this vulnerability.
PSPP: Heap Buffer Overflow
CVE: CVE-2025-47814
Component: pspp
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-10T00:00:00+00:00

A flaw was found in the GNU PSPP ZIP Reader functionality. This vulnerability allows attackers to cause a heap-based buffer overflow via a crafted ZIP archive.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
devlink: fix xa_alloc_cyclic() error handling
CVE: CVE-2025-22017
Component: kernel
CWE: CWE-395
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

devlink: fix xa_alloc_cyclic() error handling

In case of returning 1 from xa_alloc_cyclic() (wrapping) ERR_PTR(1) will
be returned, which will cause IS_ERR() to be false. Which can lead to
dereference not allocated pointer (rel).

Fix it by checking if err is lower than zero.

This wasn't found in real usecase, only noticed. Credit to Pierre.


Remediation:
thunderbird: Information disclosure in the Networking: Cache component
CVE: CVE-2025-10536
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2025-09-16T12:26:36.546000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking: Cache component.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Linux kernel: Denial of Service due to generic power domain leak
CVE: CVE-2025-68204
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel. Improper error handling during generic power domain (genpd) provider registration can lead to a memory leak. This can be exploited by a local user to trigger a kernel crash, resulting in a Denial of Service (DoS) to the system.


Remediation:
MLX has Wild Pointer Dereference in load_gguf()
CVE: CVE-2025-62609
Component: mlx
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-21T18:57:45.930000+00:00

A segmentation fault flaw has been discovered in the python MLX library. The segmentation fault exists in `mlx::core::load_gguf()` and can be triggered  when loading malicious GGUF files. An untrusted pointer from external the gguflib library is dereferenced without validation, causing an application crash.


Remediation:
Grype credential disclosure vulnerability
CVE: CVE-2025-65965
Component: github.com/anchore/grype
CVSS v3: 7.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2025-11-25T19:36:11.090000+00:00

Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
smb: client: fix potential UAF in smb2_close_cached_fid()
CVE: CVE-2025-40328
Component: kernel
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential UAF in smb2_close_cached_fid()

find_or_create_cached_dir() could grab a new reference after kref_put()
had seen the refcount drop to zero but before cfid_list_lock is acquired
in smb2_close_cached_fid(), leading to use-after-free.

Switch to kref_put_lock() so cfid_release() is called with
cfid_list_lock held, closing that gap.

Statement: This vulnerability requires local access and the ability to mount SMB/CIFS shares. The race condition window is narrow, making exploitation difficult but not impossible. Systems actively using SMB mounts are at higher risk.

Remediation:
To mitigate this issue, prevent the cifs module from being loaded if SMB/CIFS filesystem access is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
CVE: CVE-2025-40282
Component: kernel
Severity: None
Release date: 2025-12-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: 6lowpan: reset link-local header on ipv6 recv path

Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW

Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.

For the compressed one, it is done in lowpan_header_decompress().

Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------


Remediation:
vrf: use RCU protection in l3mdev_l3_out()
CVE: CVE-2025-21791
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel. l3mdev_l3_out() can be called without RCU being held, causing damage to the availability of the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net-imap rubygem vulnerable to possible DoS by memory exhaustion
CVE: CVE-2025-43857
Component: net-imap
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-04-28T16:02:04.459000+00:00

A flaw was found in Net::IMAP, a Ruby library for IMAP client functionality. This vulnerability allows a malicious server to send a large "literal" byte count, causing the client to allocate excessive memory, potentially leading to denial of service (memory exhaustion). This vulnerability could allow an attacker to overload the system's memory, causing performance degradation or crashes when connecting to untrusted or compromised IMAP servers.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Binutils: Heap Buffer Overflow
CVE: CVE-2025-7545
Component: binutils
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-07-13T21:44:08.027000+00:00

A flaw was found in binutils. The `copy_section` function in `binutils/objcopy.c` is susceptible to a heap-based buffer overflow due to improper bounds checking during data copying. This flaw allows a local attacker to provide a specially crafted file. This manipulation can lead to a denial of service.

Statement: The Moderate severity rating is based on the requirement of local access for an attacker to exploit this vulnerability. Although a successful exploit could lead to heap-based buffer overflow, the prerequisite of having an established presence on the system lowers the risk compared to remotely exploitable vulnerabilities. Red Hat products widely use GNU Binutils, a fundamental set of programming tools for creating and managing binary files, which makes this a component of significant interest. However, the attack vector significantly mitigates the immediate risk to systems.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
CVE: CVE-2025-10920
Component: gimp
CWE: CWE-787
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-10-29T19:29:35.471000+00:00

A remote code execution (RCE) vulnerability exists in GIMP due to improper bounds checking during the parsing of ICNS image files. When a user opens a specially crafted ICNS file, it can trigger an out-of-bounds write, allowing attackers to execute arbitrary code within the context of the GIMP process.

Statement: This vulnerability is rated Important rather than Moderate because it enables arbitrary code execution through a memory corruption flaw in the ICNS file parser. Although exploitation requires user interaction, the underlying issue—an out-of-bounds write—directly affects memory integrity and can allow attackers to gain control of program execution. The potential for full compromise of the application process elevates its impact beyond data exposure or denial-of-service, making it a significant security concern.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.