huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ocfs2: fix panic in failed foilio allocation
CVE: CVE-2025-37950
Component: kernel
CWE: CWE-843
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix panic in failed foilio allocation

commit 7e119cff9d0a ("ocfs2: convert w_pages to w_folios") and commit
9a5e08652dc4b ("ocfs2: use an array of folios instead of an array of
pages") save -ENOMEM in the folio array upon allocation failure and call
the folio array free code.

The folio array free code expects either valid folio pointers or NULL. 
Finding the -ENOMEM will result in a panic.  Fix by NULLing the error
folio entry.


Remediation:
thunderbird: Potential information leakage and privilege escalation in UITour actor
CVE: CVE-2025-4085
Component: firefox
CWE: CWE-200
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
Release date: 2025-04-29T13:13:39.469000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
net: better track kernel sockets lifetime
CVE: CVE-2025-21884
Component: kernel
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: better track kernel sockets lifetime

While kernel sockets are dismantled during pernet_operations->exit(),
their freeing can be delayed by any tx packets still held in qdisc
or device queues, due to skb_set_owner_w() prior calls.

This then trigger the following warning from ref_tracker_dir_exit() [1]

To fix this, make sure that kernel sockets own a reference on net->passive.

Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket
is converted to a refcounted one.

[1]

[  136.263918][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at
[  136.263918][   T35]      sk_alloc+0x2b3/0x370
[  136.263918][   T35]      inet6_create+0x6ce/0x10f0
[  136.263918][   T35]      __sock_create+0x4c0/0xa30
[  136.263918][   T35]      inet_ctl_sock_create+0xc2/0x250
[  136.263918][   T35]      igmp6_net_init+0x39/0x390
[  136.263918][   T35]      ops_init+0x31e/0x590
[  136.263918][   T35]      setup_net+0x287/0x9e0
[  136.263918][   T35]      copy_net_ns+0x33f/0x570
[  136.263918][   T35]      create_new_namespaces+0x425/0x7b0
[  136.263918][   T35]      unshare_nsproxy_namespaces+0x124/0x180
[  136.263918][   T35]      ksys_unshare+0x57d/0xa70
[  136.263918][   T35]      __x64_sys_unshare+0x38/0x40
[  136.263918][   T35]      do_syscall_64+0xf3/0x230
[  136.263918][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  136.263918][   T35]
[  136.343488][   T35] ref_tracker: net notrefcnt@ffff8880638f01e0 has 1/2 users at
[  136.343488][   T35]      sk_alloc+0x2b3/0x370
[  136.343488][   T35]      inet6_create+0x6ce/0x10f0
[  136.343488][   T35]      __sock_create+0x4c0/0xa30
[  136.343488][   T35]      inet_ctl_sock_create+0xc2/0x250
[  136.343488][   T35]      ndisc_net_init+0xa7/0x2b0
[  136.343488][   T35]      ops_init+0x31e/0x590
[  136.343488][   T35]      setup_net+0x287/0x9e0
[  136.343488][   T35]      copy_net_ns+0x33f/0x570
[  136.343488][   T35]      create_new_namespaces+0x425/0x7b0
[  136.343488][   T35]      unshare_nsproxy_namespaces+0x124/0x180
[  136.343488][   T35]      ksys_unshare+0x57d/0xa70
[  136.343488][   T35]      __x64_sys_unshare+0x38/0x40
[  136.343488][   T35]      do_syscall_64+0xf3/0x230
[  136.343488][   T35]      entry_SYSCALL_64_after_hwframe+0x77/0x7f


Remediation:
Red Hat Developer Hub user permissions
CVE: CVE-2025-5417
Component: rhdh
CWE: CWE-266
Severity: Moderate
CVSS v3: 6.8/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-08-19T00:00:00+00:00

An insufficient access control vulnerability was found in the Red Hat
Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admin/user, who has standard user access to the cluster, and the Red Hat Developer Hub namespace, can access the
rhdh/rhdh-hub-rhel9 container image and modify the image's content. This issue affects the confidentiality and integrity of the data, and any changes made are not permanent, as they reset after the pod restarts.

Statement: Red Hat Developer Hub 1.6 is not affected by this vulnerability.

Remediation:
For more about Red Hat Developer Hub, see References links
Red Hat Developer Hub 1.5 contains mitigation guidelines present at https://docs.redhat.com/en/documentation/red_hat_developer_hub/1.5/html/configuring_red_hat_developer_hub/readonlyrootfilesystem
Binutils DWARF Section Handler Memory Leak
CVE: CVE-2025-8225
Component: binutils
CWE: CWE-772
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-27T08:02:06.568000+00:00

A flaw was found in binutils. The `process_debug_info` function in the DWARF section handler exhibits a memory leak due to improper handling of debug information. This issue may allow a local attacker to trigger a resource exhaustion condition. This manipulation occurs when processing a specially crafted debug information file, which can result in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: stmmac: make sure that ptp_rate is not 0 before configuring EST
CVE: CVE-2025-38125
Component: kernel
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: make sure that ptp_rate is not 0 before configuring EST

If the ptp_rate recorded earlier in the driver happens to be 0, this
bogus value will propagate up to EST configuration, where it will
trigger a division by 0.

Prevent this division by 0 by adding the corresponding check and error
code.

Statement: This patch fixes a division-by-zero issue in the stmmac_est driver where an invalid ptp_rate value of 0 could lead to a kernel crash during Enhanced Scheduled Traffic configuration. A local attacker with high privileges could trigger this by misconfiguring the PTP subsystem.

Remediation:
Node ip SSRF
CVE: CVE-2025-59436
Component: ip
CWE: CWE-918
Severity: Low
CVSS v3: 3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2025-09-16T00:00:00+00:00

The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2024-29415.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
double free in tcprewrite via a crafted pcap file
CVE: CVE-2025-51006
Component: tcpreplay
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-09-22T00:00:00+00:00

A flaw was found in tcpreplay. A double free issue can be triggered in the tcprewrite program because the tcpedit_dlt_cleanup function indirectly calls the cleanup routine multiple times when a specially crafted pcap file is processed, resulting in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
buffer overflow in the READ_SYSCALL and WRITE_SYSCALL system calls
CVE: CVE-2025-29364
Component: spim
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-08-28T00:00:00+00:00

A flaw was found in Spim. A buffer overflow can be triggered via the READ_SYSCALL and WRITE_SYSCALL system calls due to an improper validation check of memory segment addresses before performing write or read operations, resulting in memory corruption and a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/msm: Fix pgtable prealloc error path
CVE: CVE-2025-40247
Component: kernel
Severity: None
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix pgtable prealloc error path

The following splat was reported:

    Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
    Mem abort info:
      ESR = 0x0000000096000004
      EC = 0x25: DABT (current EL), IL = 32 bits
      SET = 0, FnV = 0
      EA = 0, S1PTW = 0
      FSC = 0x04: level 0 translation fault
    Data abort info:
      ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
      CM = 0, WnR = 0, TnD = 0, TagAccess = 0
      GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    user pgtable: 4k pages, 48-bit VAs, pgdp=00000008d0fd8000
    [0000000000000010] pgd=0000000000000000, p4d=0000000000000000
    Internal error: Oops: 0000000096000004 [#1]  SMP
    CPU: 5 UID: 1000 PID: 149076 Comm: Xwayland Tainted: G S                  6.16.0-rc2-00809-g0b6974bb4134-dirty #367 PREEMPT
    Tainted: [S]=CPU_OUT_OF_SPEC
    Hardware name: Qualcomm Technologies, Inc. SM8650 HDK (DT)
    pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
    pc : build_detached_freelist+0x28/0x224
    lr : kmem_cache_free_bulk.part.0+0x38/0x244
    sp : ffff000a508c7a20
    x29: ffff000a508c7a20 x28: ffff000a508c7d50 x27: ffffc4e49d16f350
    x26: 0000000000000058 x25: 00000000fffffffc x24: 0000000000000000
    x23: ffff00098c4e1450 x22: 00000000fffffffc x21: 0000000000000000
    x20: ffff000a508c7af8 x19: 0000000000000002 x18: 00000000000003e8
    x17: ffff000809523850 x16: ffff000809523820 x15: 0000000000401640
    x14: ffff000809371140 x13: 0000000000000130 x12: ffff0008b5711e30
    x11: 00000000001058fa x10: 0000000000000a80 x9 : ffff000a508c7940
    x8 : ffff000809371ba0 x7 : 781fffe033087fff x6 : 0000000000000000
    x5 : ffff0008003cd000 x4 : 781fffe033083fff x3 : ffff000a508c7af8
    x2 : fffffdffc0000000 x1 : 0001000000000000 x0 : ffff0008001a6a00
    Call trace:
     build_detached_freelist+0x28/0x224 (P)
     kmem_cache_free_bulk.part.0+0x38/0x244
     kmem_cache_free_bulk+0x10/0x1c
     msm_iommu_pagetable_prealloc_cleanup+0x3c/0xd0
     msm_vma_job_free+0x30/0x240
     msm_ioctl_vm_bind+0x1d0/0x9a0
     drm_ioctl_kernel+0x84/0x104
     drm_ioctl+0x358/0x4d4
     __arm64_sys_ioctl+0x8c/0xe0
     invoke_syscall+0x44/0x100
     el0_svc_common.constprop.0+0x3c/0xe0
     do_el0_svc+0x18/0x20
     el0_svc+0x30/0x100
     el0t_64_sync_handler+0x104/0x130
     el0t_64_sync+0x170/0x174
    Code: aa0203f5 b26287e2 f2dfbfe2 aa0303f4 (f8737ab6)
    ---[ end trace 0000000000000000 ]---

Since msm_vma_job_free() is called directly from the ioctl, this looks
like an error path cleanup issue.  Which I think results from
prealloc_cleanup() called without a preceding successful
prealloc_allocate() call.  So handle that case better.

Patchwork: https://patchwork.freedesktop.org/patch/678677/


Remediation:
ksmbd: use aead_request_free to match aead_request_alloc
CVE: CVE-2025-38575
Component: kernel
Severity: None
Release date: 2025-04-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use aead_request_free to match aead_request_alloc

Use aead_request_free() instead of kfree() to properly free memory
allocated by aead_request_alloc(). This ensures sensitive crypto data
is zeroed before being freed.


Remediation:
js-yaml prototype pollution in merge
CVE: CVE-2025-64718
Component: js-yaml
CWE: CWE-1321
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-11-13T15:32:44.634000+00:00

A prototype pollution flaw has been discovered in the js-yaml npm library. It's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (__proto__). All users who parse untrusted yaml documents may be impacted.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Lock screen setting bypass in Firefox Focus for Android
CVE: CVE-2025-0245
Component: firefox
CWE: CWE-288
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2025-01-07T16:07:05.265000+00:00

The Mozilla Foundation's Security Advisory: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could be bypassed.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. This vulnerability is specific to Firefox Focus in Android. Red Hat is not affected.

Remediation:
Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
CVE: CVE-2025-39734
Component: kernel
Severity: None
Release date: 2025-09-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Revert "fs/ntfs3: Replace inode_trylock with inode_lock"

This reverts commit 69505fe98f198ee813898cbcaf6770949636430b.

Initially, conditional lock acquisition was removed to fix an xfstest bug
that was observed during internal testing. The deadlock reported by syzbot
is resolved by reintroducing conditional acquisition. The xfstest bug no
longer occurs on kernel version 6.16-rc1 during internal testing. I
assume that changes in other modules may have contributed to this.


Remediation:
Stack buffer overflow in e1000 device via short frames in loopback mode
CVE: CVE-2025-12464
Component: qemu-kvm
CWE: CWE-121
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-17T00:00:00+00:00

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

Statement: This CVE is rated as Moderate because the vulnerability is confined to the loopback interface. Furthermore, even though e1000 is common for legacy Operating Systems, the device is generally discouraged in modern virtualization deployments (where virtio-net is recommended).

Remediation:
CVE: CVE-2025-7979
Component: Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-07-22T17:59:49.185000+00:00

Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25463.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vault Denial of Service
CVE: CVE-2025-4656
Component: github.com/hashicorp/vault
CWE: CWE-1088
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-06-25T16:15:11.861000+00:00

A key handling flaw has been discovered in Vault. The rekey and recovery key operations may lead to a denial of service in the vault application due to uncontrolled cancellations of these operations.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
algoliasearch-helper prototype pollution
CVE: CVE-2025-3193
Component: algoliasearch-helper
CWE: CWE-1321
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-09-27T05:00:07.140000+00:00

Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the "extreme edge-case" that the resulting error is caught, code injected into the user-supplied search parameter may be exeucted.This is related to but distinct from the issue reported in [CVE-2021-23433](https://security.snyk.io/vuln/SNYK-JS-ALGOLIASEARCHHELPER-1570421).**NOTE:** This vulnerability is not exploitable in the default configuration of InstantSearch since searchParameters are not modifiable by users.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Incorrect Calculation of Buffer Size in ImageMagick's Multispectral MIFF Processing
CVE: CVE-2025-46393
Component: ImageMagick
CWE: CWE-131
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-04-23T00:00:00+00:00

A flaw was found the inImageMagick package. In multispectral MIFF image processing in ImageMagick, packet_size is mishandled. This issue is related to the rendering of all channels in an arbitrary order.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Minder does not sandbox http.send in Rego programs
CVE: CVE-2025-65109
Component: Minder
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Release date: 2025-11-21T21:56:53.667000+00:00

Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0.83, Minder users may fetch content in the context of the Minder server, which may include URLs which the user would not normally have access to. This issue has been patched in Minder Helm version 0.20250203.3849+ref.fdc94f0 and Minder Go version 0.0.84.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-7996
Component: Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2025-07-30T15:20:18.262000+00:00

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25982.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-3486
Component: Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability
Release date: 2025-04-25T02:28:13.853000+00:00

Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability.

The specific flaw exists within the implementation of the isZipEntryValide method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-25730.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Elasticsearch Allocation of Resources Without Limits or Throttling
CVE: CVE-2025-68384
Component: elasticsearch
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-18T22:04:50.131000+00:00

A flaw was found in Elasticsearch. A low-privileged authenticated user can cause an excessive memory allocation via submission of oversized user settings data, resulting in a denial of service.

Statement: This issue can only be exploited by a low-privileged authenticated user, limiting the scope to legitimate users of Elasticsearch. Additionally, the only security impact of this flaw is a denial of service due to excessive memory allocation. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To mitigate this issue, make sure that only necessary and trusted users have authentication credentials to the Elasticsearch instance, limiting the ability of malicious users to potentially exploit this vulnerability.
Krita: Heap-based buffer overflow via manipulated TGA file
CVE: CVE-2025-59820
Component: Krita
CVSS v3: 6.6/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Release date: 2025-11-26T00:00:00+00:00

A flaw was found in Krita. This vulnerability allows a heap-based buffer overflow via loading a manipulated TGA (Truevision Graphics Adapter) file.

Statement: A heap-based buffer overflow in Krita, triggered by loading a manipulated TGA file, could lead to arbitrary code execution or application instability. This issue primarily affects the integrity and availability of the Krita application when processing untrusted input.

Remediation: