huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Inappropriate implementation in V8
CVE: CVE-2025-13042
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-12T16:48:43.925000+00:00

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
CVE: CVE-2025-38312
Component: kernel
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()

In fb_find_mode_cvt(), iff mode->refresh somehow happens to be 0x80000000,
cvt.f_refresh will become 0 when multiplying it by 2 due to overflow. It's
then passed to fb_cvt_hperiod(), where it's used as a divider -- division
by 0 will result in kernel oops. Add a sanity check for cvt.f_refresh to
avoid such overflow...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Statement: A division-by-zero bug was fixed in the fb_cvt_hperiod() function of the framebuffer subsystem. Specifically, a malformed or extremely large refresh rate value could cause integer overflow in cvt.f_refresh, resulting in zero being passed to a division operation. This could lead to a kernel oops. The impact on availability is high, since it may cause the kernel to crash if invalid input is not filtered. The bug was found using the Svace static analyzer. Normally, framebuffer settings are modifiable only by root or kernel modules, so for the CVSS the required privileges High.

Remediation:
mariadb: mysqldump unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30722
Component: mysql
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Release date: 2025-04-15T20:31:15.014000+00:00

Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Client accessible data as well as  unauthorized update, insert or delete access to some of MySQL Client accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-7308
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T20:00:13.970000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26389.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ipv6: use RCU in ip6_xmit()
CVE: CVE-2025-40135
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-11-12T00:00:00+00:00

A use-after-free flaw was found in ip6_autoflowlabel in the Linux kernel's net/ipv6/ip6_output.c code. In this flaw an attacker can cause a denial of service (DoS) attack.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`
CVE: CVE-2025-26619
Component: vega
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-03-27T13:51:38.442000+00:00

A Cross-site scripting vulnerability was found in the Vega library for Node.js. In affected versions, it is possible to call JavaScript functions from the Vega expression language that were not meant to be supported.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Run `vega` without `vega.expressionInterpreter`. Alternatively, using the interpreter described in CSP safe mode (Content Security Policy) prevents arbitrary Javascript from running, so users of this mode are not affected by this vulnerability.
bpf: handle jset (if a &#38; b ...) as a jump in CFG computation
CVE: CVE-2025-38607
Component: kernel
Severity: None
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: handle jset (if a & b ...) as a jump in CFG computation

BPF_JSET is a conditional jump and currently verifier.c:can_jump()
does not know about that. This can lead to incorrect live registers
and SCC computation.

E.g. in the following example:

   1: r0 = 1;
   2: r2 = 2;
   3: if r1 & 0x7 goto +1;
   4: exit;
   5: r0 = r2;
   6: exit;

W/o this fix insn_successors(3) will return only (4), a jump to (5)
would be missed and r2 won't be marked as alive at (3).


Remediation:
Write beyond bounds in binary to base64 conversion functions
CVE: CVE-2025-4877
Component: libssh
CWE: CWE-787
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-06-24T00:00:00+00:00

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption.
This issue affects only 32-bits builds of libssh.

Statement: Red Hat Product Security classified this vulnerability as having a Moderate severity. This happens because of the complexity of the attack, the possible misusage of the libssh API and the fact the attacker may not have full control over the positions and contents written into the heap.

No supported Red Hat products are affected by this issue since only 32-bit builds are vulnerable.

Remediation:
Linux kernel: Denial of Service via integer overflow in s390/pkey memory allocation
CVE: CVE-2025-38257
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/pkey: Prevent overflow in size calculation for memdup_user()

Number of apqn target list entries contained in 'nr_apqns' variable is
determined by userspace via an ioctl call so the result of the product in
calculation of size passed to memdup_user() may overflow.

In this case the actual size of the allocated area and the value
describing it won't be in sync leading to various types of unpredictable
behaviour later.

Use a proper memdup_array_user() helper which returns an error if an
overflow is detected. Note that it is different from when nr_apqns is
initially zero - that case is considered valid and should be handled in
subsequent pkey_handler implementations.

Found by Linux Verification Center (linuxtesting.org).


Remediation:
Inappropriate implementation in Compositing
CVE: CVE-2025-13107
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-11-14T02:29:58.900000+00:00

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Jose Weak Encryption Vulnerability
CVE: CVE-2025-45767
Component: jose
CWE: CWE-327
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-08-01T00:00:00+00:00

A flaw was found in Jose, where the library uses a weak encryption algorithm, allowing an attacker to decrypt sensitive data. A network-based attacker can exploit this vulnerability without authentication. Successful exploitation results in the exposure of confidential information, potentially leading to a significant impact on data confidentiality. This weakness occurs from the use of an insecure cryptographic construction.

Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, without compromising the underlying system stability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Suricata af-packet: defrag option can lead to truncated packets affecting visibility
CVE: CVE-2025-29915
Component: Suricata
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2025-04-10T19:51:48.289000+00:00

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network interface MTU which leads to Suricata seeing truncated packets. Upgrade to Suricata 7.0.9, which uses better defaults and adds warnings for user configurations that may lead to issues.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/mlx5: handle errors in mlx5_chains_create_table()
CVE: CVE-2025-21975
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: handle errors in mlx5_chains_create_table()

In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns()
and mlx5_get_flow_namespace() must be checked to prevent NULL pointer
dereferences. If either function fails, the function should log error
message with mlx5_core_warn() and return error pointer.


Remediation:
Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation.
CVE: CVE-2025-71238
Component: kernel
CWE: CWE-672
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's `qla2xxx` block SCSI generic (bsg) interface. This vulnerability, a double free, occurs because certain vendor-specific handlers incorrectly call the `bsg_job_done` function on both successful and failed operation paths. A local user could exploit this to trigger memory corruption, leading to a kernel crash and a Denial of Service (DoS). There is also a theoretical risk of local privilege escalation due to the memory corruption.

Statement: A kernel double free can be triggered in the qla2xxx bsg interface because some vendor specific handlers called bsg_job_done on both success and failure paths. This can result in the same bsg job being completed and freed twice which leads to memory corruption and a kernel crash. The issue is not network reachable. Impact is denial of service and there is a theoretical risk of local privilege escalation because the flaw is a kernel memory corruption condition.

Remediation:
To mitigate this issue, prevent module qla2xxx from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
GNU Binutils prdbg.c tg_tag_type return value
CVE: CVE-2025-11839
Component: binutils
CWE: CWE-252
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-16T14:02:13.689000+00:00

A security flaw has been discovered in GNU Binutils 2.45. Impacted is the function tg_tag_type of the file prdbg.c. Performing a manipulation results in unchecked return value. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks.

Statement: Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GNU elfutils eu-strip elf_strptr.c elf_strptr denial of service
CVE: CVE-2025-1376
Component: elfutils
CWE: CWE-404
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-17T04:31:08.264000+00:00

A flaw was found in GNU elfutils. This vulnerability allows denial of service via manipulation of the function elf_strptr in /libelf/elf_strptr.c.

Statement: This vulnerability is rated Low for Red Hat Enterprise Linux 9 and 10. The flaw is a local application level denial of service in the elfutils component, specifically affecting the `eu-strip` utility through manipulation of the `elf_strptr` function. Exploitation requires local access and is considered to have high complexity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Apptainer: Security bypass due to disabling security options
CVE: CVE-2025-65105
Component: Apptainer
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-12-02T17:49:17.312000+00:00

A flaw was found in Apptainer. This vulnerability allows a container to disable the --security=apparmor:<profile> and --security=selinux:<label> options, bypassing security restrictions on container operations via the --security option. This affects unprivileged users on systems where Apparmor or SELinux (Security-Enhanced Linux) are enabled.

Statement: This vulnerability is rated Moderate for Red Hat because Apptainer, when running containers on RHEL-based systems with SELinux enabled, allows a container to bypass the intended security restrictions provided by the --security=selinux option. This could lead to a reduction in the security posture of the container, even when the option is explicitly used.

Remediation:
smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()
CVE: CVE-2025-39692
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy()

We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()!

Otherwise already existing connections try to use smb_direct_wq as
a NULL pointer.


Remediation:
arm64/pageattr: Propagate return value from __change_memory_common
CVE: CVE-2025-68737
Component: kernel
Severity: None
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64/pageattr: Propagate return value from __change_memory_common

The rodata=on security measure requires that any code path which does
vmalloc -> set_memory_ro/set_memory_rox must protect the linear map alias
too. Therefore, if such a call fails, we must abort set_memory_* and caller
must take appropriate action; currently we are suppressing the error, and
there is a real chance of such an error arising post commit a166563e7ec3
("arm64: mm: support large block mapping when rodata=full"). Therefore,
propagate any error to the caller.


Remediation:
CVE: CVE-2025-7975
Component: Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability
Release date: 2025-07-24T18:38:39.735000+00:00

Anritsu ShockLine CHX File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Anritsu ShockLine. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CHX files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-26913.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: nf_conncount: fix leaked ct in error paths
CVE: CVE-2025-71146
Component: kernel
Severity: Moderate
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: fix leaked ct in error paths

There are some situations where ct might be leaked as error paths are
skipping the refcounted check and return immediately. In order to solve
it make sure that the check is always called.


Remediation:
Linux kernel (macintosh/mac_hid): Denial of Service via race condition in mac_hid_toggle_emumouse
CVE: CVE-2025-68367
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's macintosh/mac_hid component. A local attacker could exploit a race condition in the mac_hid_toggle_emumouse() function by concurrently writing to the mac-hid emulation sysctl. This could lead to a double addition of an input handler, resulting in a system warning and potentially causing a Denial of Service (DoS).


Remediation:
f2fs: fix KMSAN uninit-value in extent_info usage
CVE: CVE-2025-38579
Component: kernel
Severity: None
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix KMSAN uninit-value in extent_info usage

KMSAN reported a use of uninitialized value in `__is_extent_mergeable()`
 and `__is_back_mergeable()` via the read extent tree path.

The root cause is that `get_read_extent_info()` only initializes three
fields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the
remaining fields uninitialized. This leads to undefined behavior
when those fields are accessed later, especially during
extent merging.

Fix it by zero-initializing the `extent_info` struct before population.


Remediation:
CVE: CVE-2025-14416
Component: pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability
Release date: 2025-12-11T20:36:03.401000+00:00

pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of DOC files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27503.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net_sched: prio: fix a race in prio_tune()
CVE: CVE-2025-38083
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-06-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net_sched: prio: fix a race in prio_tune()

Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer
fires at the wrong time.

The race is as follows:

CPU 0                                 CPU 1
[1]: lock root
[2]: qdisc_tree_flush_backlog()
[3]: unlock root
 |
 |                                    [5]: lock root
 |                                    [6]: rehash
 |                                    [7]: qdisc_tree_reduce_backlog()
 |
[4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog()
should fix the race, because all packets will be purged from the qdisc
before releasing the lock.


Remediation:
ipv6: mcast: add RCU protection to mld_newpack()
CVE: CVE-2025-21758
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: add RCU protection to mld_newpack()

mld_newpack() can be called without RTNL or RCU being held.

Note that we no longer can use sock_alloc_send_skb() because
ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.

Instead use alloc_skb() and charge the net->ipv6.igmp_sk
socket under RCU protection.


Remediation: