huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Crypt::CBC versions between 1.21 and 3.04 for Perl may use insecure rand() function for cryptographic functions
CVE: CVE-2025-2814
Component: Crypt-CBC
CWE: CWE-338
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-04-12T23:41:48.511000+00:00

A flaw was found in Crypt::CBC. Affected versions of Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fall back to using the insecure rand() function.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
pds_core: remove write-after-free of client_id
CVE: CVE-2025-37916
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pds_core: remove write-after-free of client_id

A use-after-free error popped up in stress testing:

[Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core]
[Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47):
[Mon Apr 21 21:21:33 2025]  pdsc_auxbus_dev_del+0xef/0x160 [pds_core]
[Mon Apr 21 21:21:33 2025]  pdsc_remove+0xc0/0x1b0 [pds_core]
[Mon Apr 21 21:21:33 2025]  pci_device_remove+0x24/0x70
[Mon Apr 21 21:21:33 2025]  device_release_driver_internal+0x11f/0x180
[Mon Apr 21 21:21:33 2025]  driver_detach+0x45/0x80
[Mon Apr 21 21:21:33 2025]  bus_remove_driver+0x83/0xe0
[Mon Apr 21 21:21:33 2025]  pci_unregister_driver+0x1a/0x80

The actual device uninit usually happens on a separate thread
scheduled after this code runs, but there is no guarantee of order
of thread execution, so this could be a problem.  There's no
actual need to clear the client_id at this point, so simply
remove the offending code.


Remediation:
md: suspend array while updating raid_disks via sysfs
CVE: CVE-2025-71225
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A race condition flaw was found in the Linux kernel's MD RAID1 driver. When updating the raid_disks count via sysfs during concurrent I/O errors, the freeze_array() function may return before all queued r1bio structures are released. This can cause free_r1bio() to access memory out of bounds and potentially corrupt the memory pool when r1bios allocated with the old raid_disks value are freed to the resized mempool.

Statement: Exploiting this flaw requires concurrent I/O errors during a RAID1 reshape operation initiated through sysfs. While the race window exists, triggering it reliably in a production environment would be challenging without control over disk I/O error injection.

Remediation:
x86: Incorrect input sanitisation in Viridian hypercalls
CVE: CVE-2025-58148
Component: xen
CVSS v3: 8.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H
Release date: 2025-10-31T11:50:28.407000+00:00

A flaw was found in Xen. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer. A buggy or malicious guest can cause Denial of Service (DoS) affecting the entire host, information leaks, or elevation of privilege.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/amd/display: Fix slab-use-after-free on hdcp_work
CVE: CVE-2025-21968
Component: kernel
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix slab-use-after-free on hdcp_work

[Why]
A slab-use-after-free is reported when HDCP is destroyed but the
property_validate_dwork queue is still running.

[How]
Cancel the delayed work when destroying workqueue.

(cherry picked from commit 725a04ba5a95e89c89633d4322430cfbca7ce128)


Remediation:
raylib: Integer overflow vulnerability in LoadFontData
CVE: CVE-2025-15534
Component: raylib
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in raylib. A local user could exploit an integer overflow vulnerability in the `LoadFontData` function. This flaw may lead to information disclosure, data modification, or denial of service, impacting the availability, integrity, and confidentiality of the application.

Statement: This vulnerability is rated Moderate for Red Hat. It is an integer overflow in the `LoadFontData` function of the `raylib` library. Exploitation requires local access to the system where `raylib` is in use and could lead to a denial of service or other impacts.

Remediation:
Optimizer unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50082
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-15T19:27:42.105000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Envoy TCP connection pool crash
CVE: CVE-2025-62409
Component: envoy-main
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-16T17:47:25.585000+00:00

Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: dev_ioctl: take ops lock in hwtstamp lower paths
CVE: CVE-2025-39908
Component: kernel
Severity: None
Release date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: dev_ioctl: take ops lock in hwtstamp lower paths

ndo hwtstamp callbacks are expected to run under the per-device ops
lock. Make the lower get/set paths consistent with the rest of ndo
invocations.

Kernel log:
WARNING: CPU: 13 PID: 51364 at ./include/net/netdev_lock.h:70 __netdev_update_features+0x4bd/0xe60
...
RIP: 0010:__netdev_update_features+0x4bd/0xe60
...
Call Trace:
<TASK>
netdev_update_features+0x1f/0x60
mlx5_hwtstamp_set+0x181/0x290 [mlx5_core]
mlx5e_hwtstamp_set+0x19/0x30 [mlx5_core]
dev_set_hwtstamp_phylib+0x9f/0x220
dev_set_hwtstamp_phylib+0x9f/0x220
dev_set_hwtstamp+0x13d/0x240
dev_ioctl+0x12f/0x4b0
sock_ioctl+0x171/0x370
__x64_sys_ioctl+0x3f7/0x900
? __sys_setsockopt+0x69/0xb0
do_syscall_64+0x6f/0x2e0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
...
</TASK>
....
---[ end trace 0000000000000000 ]---

Note that the mlx5_hwtstamp_set and mlx5e_hwtstamp_set functions shown
in the trace come from an in progress patch converting the legacy ioctl
to ndo_hwtstamp_get/set and are not present in mainline.


Remediation:
btrfs: fix symbolic link reading when bs > ps
CVE: CVE-2025-40128
Component: kernel
CWE: CWE-787
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-11-12T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
CVE: CVE-2025-7315
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T20:00:42.305000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26408.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
CVE: CVE-2025-14325
Component: firefox
CWE: CWE-94
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-09T13:37:58.843000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
HDF5 Stack Buffer Overflow
CVE: CVE-2025-6857
Component: hdf5
CWE: CWE-121
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-06-29T10:00:18.376000+00:00

A flaw was found in hdf5. The H5G__node_cmp3 function in src/H5Gnode.c contains a stack-based buffer overflow vulnerability that is triggered by manipulating data within a file. This flaw allows a local attacker to provide a specially crafted file. This issue can lead to a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-3881
Component: eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability
Release date: 2025-04-24T00:13:55.688000+00:00

eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of eCharge Hardy Barth cPH2 charging stations. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the ntp parameter provided to the check_req.php endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-23113.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
blk-cgroup: Fix class @block_class's subsystem refcount leakage
CVE: CVE-2025-21745
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: Fix class @block_class's subsystem refcount leakage

blkcg_fill_root_iostats() iterates over @block_class's devices by
class_dev_iter_(init|next)(), but does not end iterating with
class_dev_iter_exit(), so causes the class's subsystem refcount leakage.

Fix by ending the iterating with class_dev_iter_exit().


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
CVE: CVE-2025-40256
Component: kernel
CWE: CWE-459
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added

In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I
missed the case where state creation fails between full
initialization (->init_state has been called) and being inserted on
the lists.

In this situation, ->init_state has been called, so for IPcomp
tunnels, the fallback tunnel has been created and added onto the
lists, but the user state never gets added, because we fail before
that. The user state doesn't go through __xfrm_state_delete, so we
don't call xfrm_state_delete_tunnel for those states, and we end up
leaking the FB tunnel.

There are several codepaths affected by this: the add/update paths, in
both net/key and xfrm, and the migrate code (xfrm_migrate,
xfrm_state_migrate). A "proper" rollback of the init_state work would
probably be doable in the add/update code, but for migrate it gets
more complicated as multiple states may be involved.

At some point, the new (not-inserted) state will be destroyed, so call
xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states
will have their fallback tunnel cleaned up during __xfrm_state_delete,
which solves the issue that b441cf3f8c4b (and other patches before it)
aimed at. All states (including FB tunnels) will be removed from the
lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).


Remediation:
Linux kernel: Denial of Service due to improper perf_mmap() buffer mapping error handling
CVE: CVE-2025-38564
Component: kernel
CWE: CWE-390
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Handle buffer mapping fail correctly in perf_mmap()

After successful allocation of a buffer or a successful attachment to an
existing buffer perf_mmap() tries to map the buffer read only into the page
table. If that fails, the already set up page table entries are zapped, but
the other perf specific side effects of that failure are not handled.  The
calling code just cleans up the VMA and does not invoke perf_mmap_close().

This leaks reference counts, corrupts user->vm accounting and also results
in an unbalanced invocation of event::event_mapped().

Cure this by moving the event::event_mapped() invocation before the
map_range() call so that on map_range() failure perf_mmap_close() can be
invoked without causing an unbalanced event::event_unmapped() call.

perf_mmap_close() undoes the reference counts and eventually frees buffers.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
NVIDIA Display Driver vulnerability due to race condition leading to escalate privileges
CVE: CVE-2025-23282
Component: kvm
CWE: CWE-415
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-10T17:41:55.131000+00:00

NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Kitty Unconfirmed Local Executable Execution
CVE: CVE-2025-43929
Component: kitty
CVSS v3: 4.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-04-20T00:00:00+00:00

A flaw was found in kitty. This vulnerability allows arbitrary code execution via execution of a locally linked executable without user confirmation.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Kernel: Denial of Service due to null pointer dereference in USB ACPI module
CVE: CVE-2025-38134
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink()

As demonstrated by the fix for update_port_device_state,
commit 12783c0b9e2c ("usb: core: Prevent null pointer dereference in update_port_device_state"),
usb_hub_to_struct_hub() can return NULL in certain scenarios,
such as during hub driver unbind or teardown race conditions,
even if the underlying usb_device structure exists.

Plus, all other places that call usb_hub_to_struct_hub() in the same file
do check for NULL return values.

If usb_hub_to_struct_hub() returns NULL, the subsequent access to
hub->ports[udev->portnum - 1] will cause a null pointer dereference.


Remediation:
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
CVE: CVE-2025-0604
Component: keycloak-ldap-federation
CWE: CWE-287
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-01-20T00:00:00+00:00

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Use after free in Profiles
CVE: CVE-2025-1916
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-03-05T03:48:36.146000+00:00

Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
integer overflow can lead to logic/policy bypass
CVE: CVE-2025-67125
Component: docopt.cpp
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-01-01T00:00:00+00:00

A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG_MAX + first user "-v/--verbose") can cause counter wrap (negative/unbounded semantics) and lead to logic/policy bypass in applications that rely on occurrence-based limits, rate-gating, or safety toggles. In hardened builds (e.g., UBSan or -ftrapv), the overflow may also result in process abort (DoS).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list
CVE: CVE-2025-39725
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list

In shrink_folio_list(), the hwpoisoned folio may be large folio, which
can't be handled by unmap_poisoned_folio().  For THP, try_to_unmap_one()
must be passed with TTU_SPLIT_HUGE_PMD to split huge PMD first and then
retry.  Without TTU_SPLIT_HUGE_PMD, we will trigger null-ptr deref of
pvmw.pte.  Even we passed TTU_SPLIT_HUGE_PMD, we will trigger a
WARN_ON_ONCE due to the page isn't in swapcache.

Since UCE is rare in real world, and race with reclaimation is more rare,
just skipping the hwpoisoned large folio is enough.  memory_failure() will
handle it if the UCE is triggered again.

This happens when memory reclaim for large folio races with
memory_failure(), and will lead to kernel panic.  The race is as
follows:

cpu0      cpu1
 shrink_folio_list memory_failure
  TestSetPageHWPoison
  unmap_poisoned_folio
  --> trigger BUG_ON due to
  unmap_poisoned_folio couldn't
   handle large folio

[tujinjiang@huawei.com: add comment to unmap_poisoned_folio()]


Remediation:
org.apache.solr: Apache Solr: Core-creation with "trusted" configset can use arbitrary untrusted files
CVE: CVE-2025-24814
Component: solr
CWE: CWE-250
Severity: Low
CVSS v3: 4.7/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-01-27T08:58:08.768000+00:00

A flaw was found in Apache Solr. Solr instances that use the "FileSystemConfigSetService" component, the default in "standalone" or "user-managed" mode, and are running without authentication and authorization are vulnerable to a privilege escalation wherein individual "trusted" config set files can be ignored in favor of potentially-untrusted replacements available elsewhere on the filesystem.  These replacement config files are treated as "trusted" and can use "<lib>" tags to add to Solr's classpath. This flaw allows an attacker to load malicious code as a searchComponent or other plugin.


Remediation:
Users can protect against the vulnerability by enabling authentication and authorization on their Solr clusters or switching to SolrCloud (and away from "FileSystemConfigSetService").