huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Bluetooth: btrtl: Prevent potential NULL dereference
CVE: CVE-2025-37792
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: Prevent potential NULL dereference

The btrtl_initialize() function checks that rtl_load_file() either
had an error or it loaded a zero length file.  However, if it loaded
a zero length file then the error code is not set correctly.  It
results in an error pointer vs NULL bug, followed by a NULL pointer
dereference.  This was detected by Smatch:

drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'


Remediation:
vxlan: Annotate FDB data races
CVE: CVE-2025-38037
Component: kernel
Severity: Low
CVSS v3: 2.3/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Annotate FDB data races

The 'used' and 'updated' fields in the FDB entry structure can be
accessed concurrently by multiple threads, leading to reports such as
[1]. Can be reproduced using [2].

Suppress these reports by annotating these accesses using
READ_ONCE() / WRITE_ONCE().

[1]
BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit

write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:
 vxlan_xmit+0xb29/0x2380
 dev_hard_start_xmit+0x84/0x2f0
 __dev_queue_xmit+0x45a/0x1650
 packet_xmit+0x100/0x150
 packet_sendmsg+0x2114/0x2ac0
 __sys_sendto+0x318/0x330
 __x64_sys_sendto+0x76/0x90
 x64_sys_call+0x14e8/0x1c00
 do_syscall_64+0x9e/0x1a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:
 vxlan_xmit+0xadf/0x2380
 dev_hard_start_xmit+0x84/0x2f0
 __dev_queue_xmit+0x45a/0x1650
 packet_xmit+0x100/0x150
 packet_sendmsg+0x2114/0x2ac0
 __sys_sendto+0x318/0x330
 __x64_sys_sendto+0x76/0x90
 x64_sys_call+0x14e8/0x1c00
 do_syscall_64+0x9e/0x1a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f

Reported by Kernel Concurrency Sanitizer on:
CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014

[2]
 #!/bin/bash

 set +H
 echo whitelist > /sys/kernel/debug/kcsan
 echo !vxlan_xmit > /sys/kernel/debug/kcsan

 ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1
 bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1
 taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &
 taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &

Statement: This patch addresses a benign data race in the VXLAN FDB handling code, where the used and updated timestamps were concurrently accessed by multiple threads. Although not security-critical, it caused KCSAN to report a potential race condition during VXLAN traffic handling. The fix involves annotating accesses to these fields with READ_ONCE() and WRITE_ONCE() to clarify the intended relaxed access pattern and suppress false positives.

Remediation:
segmentation fault in win_line() in Vim < 9.1.1043
CVE: CVE-2025-24014
Component: vim
CWE: CWE-787
Severity: Low
CVSS v3: 4.2/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-01-20T22:53:14.325000+00:00

A flaw was found in Vim. In silent Ex mode (-s -e), Vim typically doesn't show a screen and operates silently in batch mode, however, it is possible to trigger the function that handles the scrolling of a GUI version of Vim via binary characters. The function that handles the scrolling may trigger a redraw, which will access the ScreenLines pointer and can cause a segmentation fault condition. This may lead to an application crash or other undefined behavior.

Statement: In order to trigger this issue, a local user must intentionally and explicitly feed some binary data to Vim in ex mode. Thus, Red Hat considers the impact Low.

Remediation:
Vim heap use-after-free vulnerability when processing recursive tuple data types
CVE: CVE-2025-55157
Component: vim
CWE: CWE-416
Severity: Low
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2025-08-11T22:54:27.302000+00:00

A use-after-free vulnerability was found in Vim. This flaw allows an attacker who can trick a user into processing a specially crafted file to trigger the use-after-free, causing the application to crash.

Statement: Red Hat Product Security has rated this issue as having a Low security impact because the user has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

For additional information, refer to the Issue Severity Classification [1] and Red Hat Enterprise Linux Life Cycle & Updates Policy.

[1]. https://access.redhat.com/security/updates/classification/

[2]. https://access.redhat.com/support/policy/updates/errata/

Remediation:
Do not run untrusted Vim scripts as it's not recommended.
CVE: CVE-2025-15319
Component: Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
Release date: 2025-08-07T00:00:00+00:00

Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
neurobin shc os command injection
CVE: CVE-2025-9176
Component: shc
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-08-19T23:32:07.022000+00:00

An os command injection flaw has been discovered in neurobin shc. The `make` function in the `src/shc.c` file does not properly handle environmental variables, which may lead to command injection. This vulnerability requires local access in order to exploit.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ALSA: usb-mixer: us16x08: validate meter packet indices
CVE: CVE-2025-68783
Component: kernel
CWE: CWE-1285
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

An out-of-bounds write flaw was found in the Linux kernel's ALSA USB mixer driver for Tascam US-16x08 audio interfaces. The get_meter_levels_from_urb() function extracts channel indices from USB packets without validating the range. A malicious or malfunctioning USB device can send packets with out-of-bounds channel indices, causing writes beyond allocated arrays.

Statement: Exploitation requires physical access to connect a malicious USB device or a malfunctioning Tascam US-16x08 interface. The out-of-bounds write occurs in kernel memory and could potentially be leveraged for privilege escalation, though this would require precise control of the malicious device's output.

Remediation:
MediaWiki: Information disclosure vulnerability in ImportableOldRevisionImporter.Php
CVE: CVE-2025-67476
Component: MediaWiki
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in MediaWiki. This vulnerability, located in the includes/Import/ImportableOldRevisionImporter.Php file, may allow a remote attacker with low privileges to disclose sensitive information. The flaw occurs during the processing of old revisions, potentially leading to unintended exposure of data.

Statement: This LOW impact vulnerability in MediaWiki allows for the leakage of an importer's IP address through EventStreams during the import process. This affects MediaWiki in Fedora Community Projects, specifically versions before 1.44.3 and 1.45.1.

Remediation:
integer buffer overflow causing a segfault when parsing crafted JSON
CVE: CVE-2025-40928
Component: JSON-XS
CWE: CWE-122
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-08T15:08:21.860000+00:00

A flaw was found in the JSON-XS Perl module. A buffer overflow can be triggered due to an integer overflow when a specially crafted JSON input is processed, causing a segmentation fault, crashing the application using the module and resulting in a denial of service.

Statement: Only applications processing JSON input supplied by untrusted users with the JSON-XS Perl module are vulnerable to this issue, limiting the exposure and impact of this vulnerability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration
CVE: CVE-2025-37815
Component: kernel
Severity: None
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registration

Resolve kernel panic while accessing IRQ handler associated with the
generated IRQ. This is done by acquiring the spinlock and storing the
current interrupt state before handling the interrupt request using
generic_handle_irq.

A previous fix patch was submitted where 'generic_handle_irq' was
replaced with 'handle_nested_irq'. However, this change also causes
the kernel panic where after determining which GPIO triggered the
interrupt and attempting to call handle_nested_irq with the mapped
IRQ number, leads to a failure in locating the registered handler.


Remediation:
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
CVE: CVE-2025-31492
Component: mod_auth_openidc
CWE: CWE-200
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-04-06T20:02:20.511000+00:00

A flaw was found in mod_auth_openidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present.

Statement: This vulnerability marked as important severity rather than moderate due to its direct breach of access control, one of the core pillars of web application security. The flaw allows unauthenticated users to access sensitive protected content simply by triggering a specific OpenID Connect flow, bypassing the intended authentication checks. This is not merely a misconfiguration or theoretical risk — it results from a flawed control path in mod_auth_openidc where the module returns OK for unauthenticated requests, and httpd proceeds to serve protected content. The vulnerability affects environments without strict external request validation (e.g., no reverse proxy or WAF), making it highly impactful in real-world deployments.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
CVE: CVE-2025-50181
Component: urllib3
CWE: CWE-601
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-06-19T01:08:00.340000+00:00

A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations.

Statement: A flaw was found in the urllib3 library where it could be tricked into disclosing the Proxy-Authorization header to a destination server when a CONNECT tunnel is used. An attacker can set up a malicious redirect to a crafted URL, which, when followed by the client application, will cause the Proxy-Authorization header to be sent to the attacker-controlled server. This leaks sensitive credentials for the proxy. The impact is primarily on confidentiality. While urllib3 is a ubiquitous component, the vulnerability requires a specific scenario where a user is connecting to a proxy that requires authentication and is redirected to a malicious endpoint. This lowers the exploitability compared to a direct, unauthenticated remote attack, thus, warranting a Moderate severity rating.

Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11458
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-2014
Component: Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability
Release date: 2025-03-10T22:00:45.436000+00:00

Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VS files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25235.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Keycloak SMTP Inject Vulnerability
CVE: CVE-2025-8419
Component: org.keycloak/keycloak-services
CWE: CWE-93
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-08-06T00:00:00+00:00

A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Currently, no mitigation is available for this vulnerability.
net: hibmcge: fix the division by zero issue
CVE: CVE-2025-38719
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: hibmcge: fix the division by zero issue

When the network port is down, the queue is released, and ring->len is 0.
In debugfs, hbg_get_queue_used_num() will be called,
which may lead to a division by zero issue.

This patch adds a check, if ring->len is 0,
hbg_get_queue_used_num() directly returns 0.


Remediation:
Linux kernel use-after-free in eventpoll
CVE: CVE-2025-38349
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-18T00:00:00+00:00

A flaw was found in the Linux kernel's eventpoll (epoll) mechanism. A local attacker could exploit a use-after-free vulnerability due to incorrect handling of the 'ep' refcount while the 'ep' mutex is still held. This can lead to memory corruption, potentially allowing the attacker to achieve privilege escalation or execute arbitrary code on the system.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
thunderbird: Same-origin policy bypass in the DOM: Workers component
CVE: CVE-2025-13019
Component: firefox
CWE: CWE-346
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-11-11T15:47:16.759000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the DOM: Workers component.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
MySQL Server: Denial of Service via network access
CVE: CVE-2025-21492
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:52:53.040000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.36 and prior and  8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
net: stmmac: Fix accessing freed irq affinity_hint
CVE: CVE-2025-23155
Component: kernel
Severity: None
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Fix accessing freed irq affinity_hint

In stmmac_request_irq_multi_msi(), a pointer to the stack variable
cpu_mask is passed to irq_set_affinity_hint(). This value is stored in
irq_desc->affinity_hint, but once stmmac_request_irq_multi_msi()
returns, the pointer becomes dangling.

The affinity_hint is exposed via procfs with S_IRUGO permissions,
allowing any unprivileged process to read it. Accessing this stale
pointer can lead to:

- a kernel oops or panic if the referenced memory has been released and
  unmapped, or
- leakage of kernel data into userspace if the memory is re-used for
  other purposes.

All platforms that use stmmac with PCI MSI (Intel, Loongson, etc) are
affected.


Remediation:
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver
CVE: CVE-2025-68804
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

After unbinding the driver, another kthread `cros_ec_console_log_work`
is still accessing the device, resulting an UAF and crash.

The driver doesn't unregister the EC device in .remove() which should
shutdown sub-devices synchronously.  Fix it.


Remediation:
Off-by-One Out-of-Bounds Read in find_boundary() in soup-multipart.c
CVE: CVE-2025-4969
Component: libsoup
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2025-05-20T00:00:00+00:00

A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).

Statement: Red Hat Product Security has rated this vulnerability as with Moderate severity. Although this flaw may be exploited by an unauthenticated attacker and through the network, the attacker has little to no control over the information leaked. Additionally, the amount of bytes improperly read is low (only one byte is improperly read per attack), which makes this flaw very difficult to exploit to exfiltrate meaningful sensitive data.

Remediation:
Gitea: Unauthorized access to private resources via public-scoped API tokens
CVE: CVE-2025-68941
Component: gitea
CWE: CWE-863
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Release date: 2025-12-26T02:31:59.031000+00:00

A flaw was found in Gitea. An attacker with an API token intended for public resources could exploit this vulnerability to gain unauthorized access to private resources. This misconfiguration allows for a bypass of access controls, potentially leading to information disclosure from private repositories or other sensitive data.

Statement: This vulnerability is rated Moderate for Red Hat OpenShift Pipelines. An attacker with a public-scoped API token could gain unauthorized access to private resources due to a misconfiguration in Gitea. This affects OpenShift Pipelines in update streams 1.16, 1.17, and 1.18. OpenShift Pipelines in update streams 1.19 and 1.20 are not affected as the vulnerable code is not present.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE: CVE-2025-6811
Component: Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2025-06-27T22:41:05.229000+00:00

Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the TypeResolutionService class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25397.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: