huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Incorrect Access Control (IDOR) in snipeit
CVE: CVE-2025-47226
Component: snipeit
CVSS v3: 4.6/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Release date: 2025-05-02T00:00:00+00:00

A flaw was found in the Snipe-IT component.  The affected versions contain incorrect authorization protocols for accessing asset information.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
crypto: essiv - Check ssize for decryption and in-place encryption
CVE: CVE-2025-40019
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-10-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

crypto: essiv - Check ssize for decryption and in-place encryption

Move the ssize check to the start in essiv_aead_crypt so that
it's also checked for decryption and in-place encryption.

Statement: The ESSIV AEAD path failed to validate ssize = assoclen - ivsize for decryption and in-place encryption. A negative ssize could flow into scatterwalk_map_and_copy(), causing out-of-bounds writes/reads of the IV region and kernel crashes or memory corruption. The fix computes ivsize/ssize up front, rejects ssize < 0, and consistently uses these locals across branches, covering decrypt and in-place cases. Privilege required is local (e.g., reachable via kernel crypto consumers or AF_ALG setups), with primary impact on availability and potential integrity compromise. The system is not vulnerable if ESSIV is not in use (i.e. the essiv/aes-cbc-essiv implementation is not present or not being used by any disk/crypto consumer).

Remediation:
CVE: CVE-2025-7224
Component: INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2025-07-07T18:18:38.097000+00:00

INVT HMITool VPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of INVT HMITool. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VPM files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25045.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
vim xxd xxd.c main buffer overflow
CVE: CVE-2025-9390
Component: vim
CWE: CWE-120
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-08-24T14:02:09.444000+00:00

A vulnerability was found in the xxd component of Vim in the main function of src/xxd/xxd.c. This flaw allows a local attacker to trigger a buffer overflow, which leads to a denial of service.

Statement: This vulnerability is marked MODERATE for a few reasons: first, because it's effect is localized within a victim's system. second, the buffer overflow is caught by compiler-level protection mechanisms before it can cause memory corruption, but represents a genuine security vulnerability that could be exploited in unprotected builds. The vulnerability is detected by GCC's fortify source protection mechanism and occurs when xxd processes input files with binary output (-b) and EBCDIC encoding (-E) flags, leading to buffer overflow conditions that trigger abort signals due to stack protection mechanisms.

Remediation:
Upgrade to Vim version 9.1.1616 or later to address this issue.
Processing maliciously crafted web content may disclose internal states of the app
CVE: CVE-2025-43265
Component: webkitgtk
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-08-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can trigger an out-of-bounds read due to improper input validation, resulting in the disclosure of the internal states of the application.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
USB: gadget: f_midi: f_midi_complete to call queue_work
CVE: CVE-2025-21859
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: f_midi: f_midi_complete to call queue_work

When using USB MIDI, a lock is attempted to be acquired twice through a
re-entrant call to f_midi_transmit, causing a deadlock.

Fix it by using queue_work() to schedule the inner f_midi_transmit() via
a high priority work queue from the completion handler.


Remediation:
CSRF Token Exposure via URL in Moodle mod_data Module
CVE: CVE-2025-3637
Component: moodle
CVSS v3: 3.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-04-22T12:00:00+00:00

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
HDF5 H5MM.c H5MM_realloc double free
CVE: CVE-2025-2925
Component: hdf5
CWE: CWE-415
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-28T20:00:11+00:00

A vulnerability has been found in HDF5 up to 1.14.6 and classified as problematic. This vulnerability affects the function H5MM_realloc of the file src/H5MM.c. The manipulation of the argument mem leads to double free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
rubygem-mqtt hostname validation
CVE: CVE-2025-12790
Component: rubygem-mqtt
CWE: CWE-29
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-11-06T00:00:00+00:00

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.

Statement: Satellite only uses the mqtt gem to establish a connection between the "smart-proxy" and "mosquitto", which both run on the same machine. Hence the low impact.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Save as in Devtools could download files without sanitizing the extension
CVE: CVE-2025-6435
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2025-06-24T12:28:04.603000+00:00

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability affects Firefox < 140 and Thunderbird < 140.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Squid vulnerable to information disclosure via authentication credential leakage in error handling
CVE: CVE-2025-62168
Component: squid-cache
CWE: CWE-209
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2025-10-17T16:21:30.156000+00:00

A Information Disclosure vulnerability has been identified in the Squid web caching proxy. This flaw occurs when the application fails to properly redact sensitive Hypertext Transfer Protocol (HTTP) authentication credentials from an error response. A remote client can exploit this by triggering an error condition, which allows a malicious script to bypass browser security and disclose the username and password a trusted client uses for access. This directly compromises the security of internal application credentials and security tokens, especially when Squid is configured for backend load balancing.

Statement: This vulnerability has rated as having the severity of Important by the Red Hat Product Security team as a successful exploitation may lead to sensitive information stored in the squid cache to be leaked, that may include authentication tokens for applications hosted behind the squid cache.

The leak happens due to squid cache not properly redacting request headers that may contain sensitive information out from error reports containing the request which triggered the error, resulting in a high confidentiality impact. The attacker does not need to have any kind of authentication to exploit this vulnerability.

To a squid instance to be considered vulnerable the email_err_data configuration may need to be turned on in the application configuration file. If the configuration entry is not present, the default behavior is to share such data letting the instance vulnerable.

The default behavior for squid in Red Hat Enterprise Linux distributions is to have email_err_data option enabled.

Remediation:
This vulnerability can be mitigated by disabling debug information in administration mailto links generated by Squid package. This can be accomplished in Red Hat Enterprise Linux by the following steps:

1) With administrative privileges, edit the squid configuration file located at ~~~/etc/squid/squid.conf~~~
2) Add or change this configuration entry to: ~~~email_err_data off~~~
3) Save the configuration file
4) Restart the squid application
Open Asset Import Library heap-based overflow
CVE: CVE-2025-6120
Component: assimp
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-06-16T11:31:06.030000+00:00

A vulnerability has been discovered in the Open Asset Import Library (Assimp), specifically within the read_meshes functionality of the assimp/code/AssetLib/MDL/HalfLife/HL1MDLLoader.cpp file (related to Half-Life 1 MDL file loading). This flaw can lead to a heap-based buffer overflow. Under specific conditions, exploitation of this buffer overflow could result in unpredictable program behavior, memory corruption, or arbitrary code execution.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ksmbd: fix memory leak in parse_lease_state()
CVE: CVE-2025-37962
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix memory leak in parse_lease_state()

The previous patch that added bounds check for create lease context
introduced a memory leak. When the bounds check fails, the function
returns NULL without freeing the previously allocated lease_ctx_info
structure.

This patch fixes the issue by adding kfree(lreq) before returning NULL
in both boundary check cases.


Remediation:
GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write
CVE: CVE-2025-68973
Component: GnuPG
CWE: CWE-675
Severity: Important
CVSS v3: 7.8/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2025-12-28T16:19:11.019000+00:00

A flaw was found in GnuPG. An attacker can provide crafted input to the `armor_filter` function, which incorrectly increments an index variable, leading to an out-of-bounds write. This memory corruption vulnerability may allow for information disclosure and could potentially lead to arbitrary code execution.

Statement: This vulnerability is rated Important for Red Hat products. The flaw in GnuPG's `armor_filter` function allows an attacker with local access to provide crafted input, potentially leading to information disclosure and arbitrary code execution due to an out-of-bounds write. Exploitation requires high attack complexity.

Remediation:
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
  
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
If you are using an earlier version of RHACS, you are advised to
upgrade to the version of RHACS mentioned in the synopsis and release
notes in order to take advantage of the enhancements, bug fixes, and/or
security patches in the release.
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
To mitigate this issue, users should avoid processing untrusted or unverified input with GnuPG. Exercise caution when handling GnuPG-encrypted or signed data from unknown or suspicious sources, as specially crafted input could trigger the vulnerability. This operational control reduces the attack surface by limiting exposure to malicious data.
signed integer overflow in cf2_doFlex
CVE: CVE-2025-23022
Component: freetype
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-01-10T00:00:00+00:00

A flaw was found in FreeType. In certain versions, specially crafted input may trigger an integer overflow condition. This issue can cause an application crash, leading to a denial of service.

Statement: No Red Hat products ship an affected version of FreeType.

Remediation:
From CVEorg collector
CVE: CVE-2025-11153
Component: firefox
Release date: 2025-09-30T12:49:06.524000+00:00

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 143.0.3.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Conda-build Path Traversal
CVE: CVE-2025-32799
Component: conda-build
CVSS v3: 5.2/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-06-16T20:23:02.645000+00:00

The Conda-build contains commands and tools to build Conda packages. Prior to version 25.4.0, the conda-build processing logic is vulnerable to path traversal (Tarslip) attacks due to improper sanitization of tar entry paths. This flaw allows attackers to craft tar archives containing entries with directory traversal sequences to write files outside the intended extraction directory. This issue could lead to arbitrary file overwrites, privilege escalation, or code execution if sensitive locations are targeted.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-6659
Component: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2025-06-25T21:36:30.059000+00:00

PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26734.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
File Read through Path Traversal in llama_index
CVE: CVE-2025-6209
Component: llama-index
CWE: CWE-29
Severity: Moderate
CVSS v3: 5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-07-07T12:21:10.767000+00:00

A path traversal vulnerability was found in run-llama/llama_index. This vulnerability allows an attacker to manipulate the `image_path` input to read files on the server. File access is limited to those files that the running process has permission to read.

Statement: On Red Hat systems most users are not given access to sensitive files. A compromised process using the llama index will not have access to general system secrets unless it has been given greater permission than it should have.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
btrfs: fix double free of qgroup record after failure to add delayed ref head
CVE: CVE-2025-68359
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double free of qgroup record after failure to add delayed ref head

In the previous code it was possible to incur into a double kfree()
scenario when calling add_delayed_ref_head(). This could happen if the
record was reported to already exist in the
btrfs_qgroup_trace_extent_nolock() call, but then there was an error
later on add_delayed_ref_head(). In this case, since
add_delayed_ref_head() returned an error, the caller went to free the
record. Since add_delayed_ref_head() couldn't set this kfree'd pointer
to NULL, then kfree() would have acted on a non-NULL 'record' object
which was pointing to memory already freed by the callee.

The problem comes from the fact that the responsibility to kfree the
object is on both the caller and the callee at the same time. Hence, the
fix for this is to shift the ownership of the 'qrecord' object out of
the add_delayed_ref_head(). That is, we will never attempt to kfree()
the given object inside of this function, and will expect the caller to
act on the 'qrecord' object on its own. The only exception where the
'qrecord' object cannot be kfree'd is if it was inserted into the
tracing logic, for which we already have the 'qrecord_inserted_ret'
boolean to account for this. Hence, the caller has to kfree the object
only if add_delayed_ref_head() reports not to have inserted it on the
tracing logic.

As a side-effect of the above, we must guarantee that
'qrecord_inserted_ret' is properly initialized at the start of the
function, not at the end, and then set when an actual insert
happens. This way we avoid 'qrecord_inserted_ret' having an invalid
value on an early exit.

The documentation from the add_delayed_ref_head() has also been updated
to reflect on the exact ownership of the 'qrecord' object.


Remediation:
drm/amdkfd: Destroy KFD debugfs after destroy KFD wq
CVE: CVE-2025-39706
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Destroy KFD debugfs after destroy KFD wq

Since KFD proc content was moved to kernel debugfs, we can't destroy KFD
debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior
to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens
when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but
kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line
    debugfs_remove_recursive(entry->proc_dentry);
tries to remove /sys/kernel/debug/kfd/proc/<pid> while
/sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel
NULL pointer.

(cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)


Remediation: