huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
regulator: pca9450: Use devm_register_sys_off_handler
CVE: CVE-2025-39771
Component: kernel
Severity: None
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

regulator: pca9450: Use devm_register_sys_off_handler

With module test, there is error dump:
------------[ cut here ]------------
  notifier callback pca9450_i2c_restart_handler already registered
  WARNING: kernel/notifier.c:23 at notifier_chain_register+0x5c/0x88,
  CPU#0: kworker/u16:3/50
  Call trace:
  notifier_chain_register+0x5c/0x88 (P)
  atomic_notifier_chain_register+0x30/0x58
  register_restart_handler+0x1c/0x28
  pca9450_i2c_probe+0x418/0x538
  i2c_device_probe+0x220/0x3d0
  really_probe+0x114/0x410
  __driver_probe_device+0xa0/0x150
  driver_probe_device+0x40/0x114
  __device_attach_driver+0xd4/0x12c

So use devm_register_sys_off_handler to let kernel handle the resource
free to avoid kernel dump.


Remediation:
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
CVE: CVE-2025-68284
Component: kernel
CWE: CWE-787
Severity: Important
CVSS v3: 6.6/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2025-12-16T00:00:00+00:00

An out-of-bounds write vulnerability was found in the Ceph authentication handling code in the Linux kernel. The handle_auth_session_key() function uses a length field from network packets without proper validation, potentially allowing out-of-bounds memory writes during connection secret decryption or service ticket processing.

Statement: A malicious Ceph monitor or man-in-the-middle attacker could exploit this by sending specially crafted authentication responses. Systems using CephFS or RBD are potentially affected.

Remediation:
GNU libmicrohttpd null pointer dereference
CVE: CVE-2025-62689
Component: libmicrohttpd
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-10T04:10:57.970000+00:00

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.

Statement: The availability impact of this flaw is limited to applications using libmicrohttpd. Red Hat host operating systems are not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-7316
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T20:00:46.288000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26410.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
pypdf manipulated LZWDecode streams can exhaust RAM
CVE: CVE-2025-66019
Component: pypdf
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-25T23:38:12.473000+00:00

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patched in version 6.4.0.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
CVE: CVE-2025-40081
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf: arm_spe: Prevent overflow in PERF_IDX2OFF()

Cast nr_pages to unsigned long to avoid overflow when handling large
AUX buffer sizes (>= 2 GiB).

Statement: The patch fixes an integer overflow in the PERF_IDX2OFF() macro used by ARM SPE perf events.
When nr_pages exceeded 2 GiB worth of buffer pages, (buf->nr_pages << PAGE_SHIFT) could overflow due to nr_pages being int.
This caused incorrect buffer offsets or wraparounds during AUX trace handling, potentially corrupting trace data or causing a kernel crash.
Exploitation requires local privileged access to configure large perf AUX buffers.

Remediation:
ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
CVE: CVE-2025-38249
Component: kernel
Severity: Moderate
CVSS v3: 4.5/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-07-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()

In snd_usb_get_audioformat_uac3(), the length value returned from
snd_usb_ctl_msg() is used directly for memory allocation without
validation. This length is controlled by the USB device.

The allocated buffer is cast to a uac3_cluster_header_descriptor
and its fields are accessed without verifying that the buffer
is large enough. If the device returns a smaller than expected
length, this leads to an out-of-bounds read.

Add a length check to ensure the buffer is large enough for
uac3_cluster_header_descriptor.

Statement: The vulnerability in snd_usb_get_audioformat_uac3() stems from an out-of-bounds read caused by a lack of validation on the length of a USB descriptor returned by the device. A malicious USB device can supply a shorter-than-expected buffer, leading to unauthorized memory access. For the CVSS the Privileges Required is Low. Although no system privileges are required, the attacker must be able to plug in a crafted USB device, which typically implies physical access or control over a local port.

Remediation:
Use-after-free in the Audio/Video: GMP component
CVE: CVE-2025-14326
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-12-09T13:38:00.695000+00:00

Use-after-free in the Audio/Video: GMP component. This vulnerability affects Firefox < 146 and Thunderbird < 146.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
thunderbird: Privilege escalation in Firefox Updater
CVE: CVE-2025-2817
Component: firefox
CWE: CWE-94
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-04-29T13:13:33.783000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
yarnpkg regular expression denial of service
CVE: CVE-2025-9308
Component: yarn
CWE: CWE-1333
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-21T16:02:12.172000+00:00

A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. Such manipulation leads to inefficient regular expression complexity. Local access is required to approach this attack. This vulnerability only affects products that are no longer supported by the maintainer.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net_sched: drr: Fix double list add in class with netem as child qdisc
CVE: CVE-2025-37915
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net_sched: drr: Fix double list add in class with netem as child qdisc

As described in Gerrard's report [1], there are use cases where a netem
child qdisc will make the parent qdisc's enqueue callback reentrant.
In the case of drr, there won't be a UAF, but the code will add the same
classifier to the list twice, which will cause memory corruption.

In addition to checking for qlen being zero, this patch checks whether the
class was already added to the active_list (cl_is_active) before adding
to the list to cover for the reentrant case.

[1] https://lore.kernel.org/netdev/CAHcdcOm+03OD2j6R0=YHKqmy=VgJ8xEOKuP6c7mSgnp-TEJJbw@mail.gmail.com/


Remediation:
wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP
CVE: CVE-2025-71226
Component: kernel
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A compatibility issue was found in the Linux kernel's iwlwifi driver. The PTP clock registration for MVM/MLD interfaces lacks the required settime64 callback, causing a warning and PTP clock registration failure when the wireless interface starts. The fix adds a stub function returning -EOPNOTSUPP to satisfy the API requirement.

Statement: This is a driver compatibility issue rather than a security vulnerability. The missing callback causes a warning message and prevents PTP clock functionality from registering on Intel wireless adapters. There is no crash, data corruption, or exploitable behavior—the system continues to function normally without PTP support on the affected interface.

Remediation:
Mapnik: Heap-based buffer overflow via string_value function manipulation
CVE: CVE-2025-15537
Component: mapnik
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Mapnik. A local attacker can exploit a heap-based buffer overflow vulnerability by manipulating the mapnik::dbf_file::string_value function in plugins/input/shape/dbfile.cpp. This vulnerability can lead to information disclosure, data integrity issues, and denial of service. A public exploit for this issue has been disclosed.

Statement: This vulnerability is rated Moderate for Red Hat because it requires local access to trigger a heap-based buffer overflow in the Mapnik library when processing specially crafted shape files. Exploitation requires an attacker to have local user access to a system utilizing Mapnik to process untrusted data.

Remediation:
mysqldump unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50081
Component: mysql
Severity: Low
CVSS v3: 3.5/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-07-15T19:27:41.718000+00:00

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Client.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Client accessible data as well as  unauthorized read access to a subset of MySQL Client accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).


Remediation:
pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
CVE: CVE-2025-37850
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()

With CONFIG_COMPILE_TEST && !CONFIG_HAVE_CLK, pwm_mediatek_config() has a
divide-by-zero in the following line:

	do_div(resolution, clk_get_rate(pc->clk_pwms[pwm->hwpwm]));

due to the fact that the !CONFIG_HAVE_CLK version of clk_get_rate()
returns zero.

This is presumably just a theoretical problem: COMPILE_TEST overrides
the dependency on RALINK which would select COMMON_CLK.  Regardless it's
a good idea to check for the error explicitly to avoid divide-by-zero.

Fixes the following warning:

  drivers/pwm/pwm-mediatek.o: warning: objtool: .text: unexpected end of section

[ukleinek: s/CONFIG_CLK/CONFIG_HAVE_CLK/]


Remediation:
Ruby WEBrick Request Smuggling Vulnerability
CVE: CVE-2025-6442
Component: webrick
CWE: CWE-444
Severity: Moderate
CVSS v3: 6.4/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Release date: 2025-06-25T16:52:24.625000+00:00

A request smuggling vulnerability has been discovered in the Ruby WEBrick gem. This vulnerability is exploitable when the product is deployed behind a HTTP proxy that fulfills specific conditions.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
IDOR in web service allows users enrolled in a course to access some details of other users
CVE: CVE-2025-3640
Component: moodle
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-04-22T12:00:00+00:00

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-43212
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-08-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
pymdown-extensions: PyMdown Extensions: Regular Expression Denial of Service in figure caption extension
CVE: CVE-2025-68142
Component: PyMdown
CWE: CWE-1333
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-16T18:06:37.756000+00:00

A flaw was found in PyMdown Extensions. This vulnerability allows a Regular Expression Denial of Service (ReDOS) via a crafted malicious payload in unchecked user content processed by the figure caption extension (pymdownx.blocks.caption).

Statement: This vulnerability is rated Low for Red Hat as it requires processing of unchecked user-provided markdown content with the `pymdownx.blocks.caption` extension enabled, without proper safeguards like timeouts. Exploitation is limited to applications that explicitly utilize this specific extension and do not implement robust input validation or resource limits.

Remediation:
To mitigate this issue, avoid using the `pymdownx.blocks.caption` extension within PyMdown Extensions when processing untrusted user-provided markdown content. This can be achieved by disabling the extension in the application's configuration or by ensuring that input is properly sanitized and processed with resource limits to prevent excessive processing time.
PS unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30696
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:31:05.017000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
CVE: CVE-2025-7253
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:38.740000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26112.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
GitLab: Unauthorized access to AI model settings via namespace identifier manipulation
CVE: CVE-2025-13772
Component: gitlab
CWE: CWE-862
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in GitLab. An authenticated user could exploit this vulnerability by manipulating namespace identifiers in API requests. This could allow them to access and utilize AI model settings from unauthorized namespaces, leading to information disclosure and potential misuse of AI resources.


Remediation:
net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
CVE: CVE-2025-38422
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices

Maximum OTP and EEPROM size for hearthstone PCI1xxxx devices are 8 Kb
and 64 Kb respectively. Adjust max size definitions and return correct
EEPROM length based on device. Also prevent out-of-bound read/write.

Statement: A vulnerability in the lan743x Ethernet driver allowed out-of-bounds read/write access to EEPROM and OTP memory on Microchip PCI1xxxx-based devices due to improper bounds checking. This could lead to system instability or denial of service when exploited by a privileged local attacker. The vulnerability is mitigated by introducing correct size limits and validating access ranges.

Privileges Required: High, as the attacker needs administrative access (e.g., via ethtool). The vulnerability is only relevant on systems using the lan743x driver with PCI1xxxx devices.

Privileges Required is set to High because triggering the vulnerability requires administrative access, such as root privileges, to execute ethtool operations or access ioctl interfaces capable of invoking EEPROM or OTP read/write routines within the lan743x driver.

Not actual for the Red Hat Enterprise Linux (all versions), so not affected.

Remediation:
Support for the Microchip LAN743x and PCI11x1x families of PCI is disabled for all versions of Red Hat Enterprise Linux, so mitigation not required.
NULL Pointer Dereference in ollama/ollama
CVE: CVE-2025-0312
Component: ollama
CWE: CWE-476
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-20T10:10:53.551000+00:00

A flaw was found in Ollama. This vulnerability allows a malicious user to create a customized GGUF model file that, when uploaded and processed on the Ollama server, causes a crash due to an unchecked null pointer dereference. This issue can lead to a denial of service (DoS) attack via a remote network.

Statement: No Red Hat products are affected by this vulnerability.

This vulnerability marked as an Important severity rating rather than a Moderate  because it allows a remote, unauthenticated attacker to completely disrupt the availability of the Ollama server by triggering an unchecked NULL pointer dereference. 

This flaw allows for a trivial, one-step attack by uploading and creating a malicious GGUF model. Given that Ollama is often used in production environments for AI model serving, an attacker can repeatedly exploit this flaw to persistently crash the server, leading to significant downtime, operational disruptions, and potential financial loss. Furthermore, if the crash occurs in a shared or cloud-hosted environment, it could impact multiple users, escalating the overall risk.

Remediation: