huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2025-2532
Component: Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2025-03-20T14:17:03.455000+00:00

Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of usdc files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23709.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Conda-build Code Execution
CVE: CVE-2025-32798
Component: conda-build
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-06-16T20:10:06.902000+00:00

The conda-build contains commands and tools to build conda packages. The conda-build recipe processing logic was found to be vulnerable to arbitrary code execution due to unsafe evaluation of recipe selectors. Currently, conda-build uses the eval function to process embedded selectors in meta.yaml files. This approach evaluates user-defined expressions without proper sanitization, which allows arbitrary code to be executed during the build process.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
aiohttp: Denial of Service via specially crafted invalid cookies
CVE: CVE-2025-69230
Component: aiohttp
CWE: CWE-779
Severity: Low
CVSS v3: 5.3/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. A remote attacker can exploit this vulnerability by sending multiple specially crafted invalid cookies. This can trigger a storm of warning-level logs, leading to a Denial of Service (DoS) condition where the application's resources are exhausted.

Statement: This vulnerability is rated Low for Red Hat products. A flaw in aiohttp allows a remote attacker to trigger a logging storm by sending specially crafted invalid cookies, leading to resource exhaustion and a Denial of Service condition. This impact occurs if the application accesses the cookies attribute.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
CVE: CVE-2025-38395
Component: kernel
CWE: CWE-122
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods

drvdata::gpiods is supposed to hold an array of 'gpio_desc' pointers. But
the memory is allocated for only one pointer. This will lead to
out-of-bounds access later in the code if 'config::ngpios' is > 1. So
fix the code to allocate enough memory to hold 'config::ngpios' of GPIO
descriptors.

While at it, also move the check for memory allocation failure to be below
the allocation to make it more readable.

Statement: This flaw is reachable only through privileged control paths: the attacker must be able to provision or modify kernel-space regulator configuration (e.g., device tree/ACPI tables, module parameters, or platform driver binding) to set ngpios > 1 and trigger allocation/use. Unprivileged users cannot influence the driver’s probe arguments or the size of the gpiods array at runtime. Therefore Privileges Required = High (PR:H), typically requiring root/CAP_SYS_ADMIN or build/boot-time control of the hardware description.

Remediation:
To mitigate this issue, prevent module gpio-regulator from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Linux kernel: Use-after-free in device mapper due to race condition in zone reporting
CVE: CVE-2025-38141
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's device mapper (dm) component. When setting up zone append emulation resources, a race condition can occur if the `blk_revalidate_disk_zones()` function fails while another process simultaneously calls `dm_blk_report_zones()`. This timing issue can lead to a use-after-free error, potentially allowing a local attacker to achieve privilege escalation or cause a denial of service.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2025-24162
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-27T21:45:54.015000+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

This issue can cause an unexpected process crash. Additionally, there is no evidence of remote code execution but this possibility is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
GIMP ICO File Parsing Integer Overflow
CVE: CVE-2025-5473
Component: gimp
CWE: CWE-190
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-06T18:44:38.495000+00:00

An integer overflow vulnerability was found in Gimp's handling of ICO files. This vulnerability can lead to code execution if a user is convinced to open a maliciously crafted file.

Statement: The initial report seems to erroneously discuss a remote attack vector; however remote access within Red Hat software does not appear possible and the upstream CNA has also assessed this as a local attack only.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Moodle: Brute-force facilitation due to missing rate limiting in confirmation email service
CVE: CVE-2025-67853
Component: moodle
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-12-15T04:00:00+00:00

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks against user accounts.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-8611
Component: AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability
Release date: 2025-08-06T14:13:20.145000+00:00

AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of AOMEI Cyber Backup. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the DaoService service, which listens on TCP port 9074 by default. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-26158.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/xe/pf: Clear all LMTT pages on alloc
CVE: CVE-2025-38511
Component: kernel
CWE: CWE-824
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe/pf: Clear all LMTT pages on alloc

Our LMEM buffer objects are not cleared by default on alloc
and during VF provisioning we only setup LMTT PTEs for the
actually provisioned LMEM range. But beyond that valid range
we might leave some stale data that could either point to some
other VFs allocations or even to the PF pages.

Explicitly clear all new LMTT page to avoid the risk that a
malicious VF would try to exploit that gap.

While around add asserts to catch any undesired PTE overwrites
and low-level debug traces to track LMTT PT life-cycle.

(cherry picked from commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d)


Remediation:
most: usb: Fix use-after-free in hdm_disconnect
CVE: CVE-2025-40223
Component: kernel
Severity: None
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

most: usb: Fix use-after-free in hdm_disconnect

hdm_disconnect() calls most_deregister_interface(), which eventually
unregisters the MOST interface device with device_unregister(iface->dev).
If that drops the last reference, the device core may call release_mdev()
immediately while hdm_disconnect() is still executing.

The old code also freed several mdev-owned allocations in
hdm_disconnect() and then performed additional put_device() calls.
Depending on refcount order, this could lead to use-after-free or
double-free when release_mdev() ran (or when unregister paths also
performed puts).

Fix by moving the frees of mdev-owned allocations into release_mdev(),
so they happen exactly once when the device is truly released, and by
dropping the extra put_device() calls in hdm_disconnect() that are
redundant after device_unregister() and most_deregister_interface().

This addresses the KASAN slab-use-after-free reported by syzbot in
hdm_disconnect(). See report and stack traces in the bug link below.


Remediation:
wifi: ath12k: Correct tid cleanup when tid setup fails
CVE: CVE-2025-39750
Component: kernel
CWE: CWE-459
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Correct tid cleanup when tid setup fails

Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(),
the tid value is already incremented, even though the corresponding
TID is not actually allocated. Proceed to
ath12k_dp_rx_peer_tid_delete() starting from unallocated tid,
which might leads to freeing unallocated TID and cause potential
crash or out-of-bounds access.

Hence, fix by correctly decrementing tid before cleanup to match only
the successfully allocated TIDs.

Also, remove tid-- from failure case of ath12k_dp_rx_peer_frag_setup(),
as decrementing the tid before cleanup in loop will take care of this.

Compile tested only.

Statement: This vulnerability primarily impacts availability, as triggering it can result in a kernel panic and a denial of service. Confidentiality is not impacted as there is no sensitive data being handled or exposed; similarly, integrity could potentially be impacted, but if so, is limited to driver-internal data structures.

Remediation:
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
CVE: CVE-2025-25289
Component: @octokit/request-error
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-14T19:35:19.998000+00:00

A Regular Expression Denial of Service (ReDoS) vulnerability exists in @octokit/request-error's processing of HTTP request headers. This flaw is triggered by an authorization header containing an excessively long sequence of spaces followed by a newline and "@" symbol, leading to excessive resource consumption and a potential denial of service (DoS).


Remediation:
RDMA/cm: Fix leaking the multicast GID table reference
CVE: CVE-2025-71084
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cm: Fix leaking the multicast GID table reference

If the CM ID is destroyed while the CM event for multicast creating is
still queued the cancel_work_sync() will prevent the work from running
which also prevents destroying the ah_attr. This leaks a refcount and
triggers a WARN:

   GID entry ref leak for dev syz1 index 2 ref=573
   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
   WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886

Destroy the ah_attr after canceling the work, it is safe to call this
twice.


Remediation:
NULL pointer dereference during DTLS operations
CVE: CVE-2025-65497
Component: libcoap
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-24T00:00:00+00:00

A flaw was found in libcoap. A remote attacker can cause a denial of service via a NULL pointer dereference due to improper handling of the return values of OpenSSL functions during DTLS (Datagram Transport Layer Security) operations.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Missing authorisation checks in BigBlueButton view page
CVE: CVE-2025-49517
Component: moodle
Release date: 2025-06-17T00:00:00+00:00

A vulnerability was found in Moodle. An insufficient authorization check could allow users to view BigBlueButton recordings they do not have permission to access. This results in loss of data confidentiality for sensitive content.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fs/hfs: Integer overflow may lead to heap based out-of-bounds write
CVE: CVE-2025-1125
Component: grub2
CWE: CWE-787
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-02-18T18:00:00+00:00

When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the hfsplus_open_compressed_real() function will write past of the internal buffer length. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections.

Statement: To exploit this flaw, an attacker needs to trick a user into running grub2 with a specially crafted HFS file system image, limiting the exposure of this flaw. For this reason, this vulnerability has been rated with a Moderate severity.

The grub2 package as shipped in Red Hat Enterprise Linux 7, 8, 9 and in Red Hat OpenShift Container Platform 4 is not affected by this vulnerability because the HFS module is not built, so this issue is not applicable.

Remediation:
Do not run grub2 in an untrusted environment, specifically with a HFS file system image.
FontForge: Remote Code Execution via SFD File Parsing Use-After-Free Vulnerability
CVE: CVE-2025-15280
Component: fontforge
CWE: CWE-416
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-31T06:59:18.875000+00:00

A flaw was found in FontForge. This use-after-free vulnerability in the SFD file parsing component allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a specially crafted malicious SFD file or visiting a malicious web page. Successful exploitation can lead to arbitrary code execution in the context of the current user.

Statement: This vulnerability is rated Important for Red Hat products because it allows remote code execution in FontForge due to a use-after-free flaw during SFD file parsing. Exploitation requires user interaction, specifically opening a specially crafted malicious SFD file or visiting a malicious web page. This affects FontForge in Red Hat Enterprise Linux and Red Hat In-Vehicle OS.

Remediation:
To mitigate this issue, users should avoid opening untrusted SFD files or visiting untrusted web pages that may attempt to exploit this vulnerability. If FontForge is not required, consider removing the `fontforge` package to eliminate the attack surface. Removing this package may impact functionality that relies on font editing capabilities.
Open Asset Import Library Assimp File types.h Set heap-based overflow
CVE: CVE-2025-3548
Component: Assimp
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-04-14T02:31:05.592000+00:00

A flaw was found in Open Asset Import Library Assimp. This issue affects the aiString::Set function in the library, include/assimp/types.h of the component File Handler. Manipulation leads to a heap-based buffer overflow.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
CVE: CVE-2025-31675
Component: drupal
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-03-31T21:35:20.059000+00:00

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-14491
Component: RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability
Release date: 2025-12-19T14:28:11.983000+00:00

RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27660.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
can: bcm: add locking for bcm_op runtime updates
CVE: CVE-2025-38004
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-06-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: add locking for bcm_op runtime updates

The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via
hrtimer. The content and also the length of the sequence can be changed
resp reduced at runtime where the 'currframe' counter is then set to zero.

Although this appeared to be a safe operation the updates of 'currframe'
can be triggered from user space and hrtimer context in bcm_can_tx().
Anderson Nascimento created a proof of concept that triggered a KASAN
slab-out-of-bounds read access which can be prevented with a spin_lock_bh.

At the rework of bcm_can_tx() the 'count' variable has been moved into
the protected section as this variable can be modified from both contexts
too.


Remediation:
Assimp MDC File Parser Out-of-Bounds Read
CVE: CVE-2025-5166
Component: assimp
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-26T03:00:12.418000+00:00

A flaw was found in the Open Asset Import Library (Assimp) MDC File Parser. This vulnerability allows out-of-bounds memory reads via manipulation of a function argument.


Remediation: