huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
libpq: libpq undersizes allocations, via integer wraparound
CVE: CVE-2025-12818
Component: postgresql
CWE: CWE-190
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-13T13:00:12.911000+00:00

A vulnerability has been identified in PostgreSQL’s libpq client library, where integer wraparound in several allocation-size calculations allows a peer or input provider to cause an undersized buffer and then write out-of-bounds by hundreds of megabytes. This can lead to a client application segmentation fault or crash when using libpq to connect to a PostgreSQL server.

Statement: This issue is rated Moderate severity by Red Hat Product Security, even though it carries a High CVSS v3.1 score. The flaw resides in the libpq client library and can be triggered when a client receives specially crafted PostgreSQL protocol data that causes an integer wraparound and an out-of-bounds write. The attack complexity is Low because the malformed protocol message is processed immediately during connection, with no timing or environmental conditions required. However, the impact is limited to a denial of service of the client application only. As a result, Red Hat classifies the overall product impact as Moderate, reflecting that the flaw can interrupt client availability.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Suricata: Stack buffer overflow in rule parser when processing long keywords with transforms
CVE: CVE-2025-59149
Component: Suricata
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-01T20:07:44.042000+00:00

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In version 8.0.0, rules using keyword ldap.responses.attribute_type (which is long) with transforms can lead to a stack buffer overflow during Suricata startup or during a rule reload. This issue is fixed in version 8.0.1. To workaround this issue, users can disable rules with ldap.responses.attribute_type and transforms.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Assimp: Out-of-Bounds Read Vulnerability
CVE: CVE-2025-5168
Component: assimp
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-26T04:00:10.764000+00:00

A flaw was found in the Open Asset Import Library (Assimp). This vulnerability allows an out-of-bounds read via manipulation of an argument during MDL file import.


Remediation:
read: Integer overflow may lead to out-of-bounds write
CVE: CVE-2025-0690
Component: grub2
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.3/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-02-18T18:00:00+00:00

The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.

Statement: Red Hat Product Security has rated this vulnerability with Moderate severity as it requires physical access and high privileges to exploit it.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Argo CD does not scrub secret values from patch errors
CVE: CVE-2025-23216
Component: argocd
CWE: CWE-209
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Release date: 2025-01-30T15:30:05.405000+00:00

A vulnerability was found in Argo CD where secret values can be exposed in error messages when an invalid Kubernetes Secret resource is synced from a repository. An attacker must have write access to the repository and any user with read access can view the exposed data.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
jfs: add sanity check for agwidth in dbMount
CVE: CVE-2025-37740
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: add sanity check for agwidth in dbMount

The width in dmapctl of the AG is zero, it trigger a divide error when
calculating the control page level in dbAllocAG.

To avoid this issue, add a check for agwidth in dbAllocAG.


Remediation:
fs/proc: fix softlockup in __read_vmcore (part 2)
CVE: CVE-2025-21694
Component: kernel
Severity: Low
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs/proc: fix softlockup in __read_vmcore (part 2)

Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the
number of softlockups in __read_vmcore at kdump time have gone down, but
they still happen sometimes.

In a memory constrained environment like the kdump image, a softlockup is
not just a harmless message, but it can interfere with things like RCU
freeing memory, causing the crashdump to get stuck.

The second loop in __read_vmcore has a lot more opportunities for natural
sleep points, like scheduling out while waiting for a data write to
happen, but apparently that is not always enough.

Add a cond_resched() to the second loop in __read_vmcore to (hopefully)
get rid of the softlockups.

Statement: The security impact is limited, because actual only for kdump and the result is softlockup.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
eth: bnxt: fix out-of-range access of vnic_info array
CVE: CVE-2025-22112
Component: kernel
CWE: CWE-805
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: fix out-of-range access of vnic_info array

The bnxt_queue_{start | stop}() access vnic_info as much as allocated,
which indicates bp->nr_vnics.
So, it should not reach bp->vnic_info[bp->nr_vnics].


Remediation:
s390/fpu: Fix false-positive kmsan report in fpu_vstl()
CVE: CVE-2025-68751
Component: kernel
CWE: CWE-131
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A false-positive memory sanitizer (KMSAN) warning was found in the Linux kernel's s390 floating-point unit (FPU) code. The vstl inline assembly instruction writes a variable number of bytes depending on runtime values, but the compiler-generated KMSAN instrumentation incorrectly tracked only 1 byte of the write. This caused spurious "uninitialized value" warnings during normal network operations like ping, though no actual memory safety issue exists.

Statement: This is a fix for false-positive KMSAN reports on s390 architecture, not a real security vulnerability. The underlying code was functioning correctly; only the sanitizer instrumentation was inaccurate. This affects only kernel developers running KMSAN-enabled debug builds on s390 systems.

Remediation:
NULL pointer dereference during DTLS operations
CVE: CVE-2025-65499
Component: libcoap
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-24T00:00:00+00:00

A flaw was found in libcoap. A remote attacker can cause a denial of service via a NULL pointer dereference due to improper handling of the return values of OpenSSL functions during DTLS (Datagram Transport Layer Security) operations.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
radare2 memory leak
CVE: CVE-2025-60361
Component: radare2
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-10-17T00:00:00+00:00

radare2 v5.9.8 and before contains a memory leak in the function bochs_open.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Quadratic parsing complexity in golang.org/x/net/html
CVE: CVE-2025-47911
Component: golang.org/x/net/html
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.


Remediation:
FFmpeg AAC Encoder aacenc_tns.c ff_aac_search_for_tns stack-based overflow
CVE: CVE-2025-1594
Component: ffmpeg
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-02-23T21:00:13.152000+00:00

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service in SUNRPC via zero-length gss_token
CVE: CVE-2025-71120
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's SUN Remote Procedure Call (SUNRPC) subsystem, specifically within the svcauth_gss module. A remote attacker could exploit this vulnerability by providing a zero-length Generic Security Service (GSS) token. This can lead to a NULL pointer dereference in the gss_read_proxy_verf function, causing a system crash and resulting in a denial of service (DoS).


Remediation:
Use-After-Free in Fluent Bit YAML Config Parser
CVE: CVE-2025-29477
Component: fluent-bit
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-04T00:00:00+00:00

An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
CVE: CVE-2025-47291
Component: containerd
CWE: CWE-266
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-05-21T17:26:31.141000+00:00

A vulnerability has been identified in containerd's Container Runtime Interface (CRI) implementation, affecting versions from 2.0.1 up to, but not including, 2.0.5. The flaw lies in the fact that containerd does not correctly place usernamespaced containers within the Kubernetes cgroup hierarchy. As a result, Kubernetes-defined resource limits for these containers are not properly enforced. This issue can lead to uncontrolled resource consumption by affected containers, potentially exhausting the resources of the Kubernetes node and resulting in a denial-of-service condition for the entire node.


Remediation:
This vulnerability has been resolved in containerd versions 2.0.5 and later, as well as 2.1.0 and later. We recommend upgrading all affected containerd installations to these versions to remediate the issue. 

As a temporary workaround, if immediate upgrade is not feasible, temporarily disable usernamespaced pods within your Kubernetes environment.
Apache HTTP Server: NTLM Leakage on Windows via SSRF
CVE: CVE-2025-59775
Component: httpd
CWE: CWE-918
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-12-05T10:17:03.852000+00:00

A server side request forgery flaw has been discovered in the Apache HTTP server. The Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content.


Remediation:
pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
CVE: CVE-2025-38266
Component: kernel
Severity: None
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms

Commit 3ef9f710efcb ("pinctrl: mediatek: Add EINT support for multiple
addresses") introduced an access to the 'soc' field of struct
mtk_pinctrl in mtk_eint_do_init() and for that an include of
pinctrl-mtk-common-v2.h.

However, pinctrl drivers relying on the v1 common driver include
pinctrl-mtk-common.h instead, which provides another definition of
struct mtk_pinctrl that does not contain an 'soc' field.

Since mtk_eint_do_init() can be called both by v1 and v2 drivers, it
will now try to dereference an invalid pointer when called on v1
platforms. This has been observed on Genio 350 EVK (MT8365), which
crashes very early in boot (the kernel trace can only be seen with
earlycon).

In order to fix this, since 'struct mtk_pinctrl' was only needed to get
a 'struct mtk_eint_pin', make 'struct mtk_eint_pin' a parameter
of mtk_eint_do_init() so that callers need to supply it, removing
mtk_eint_do_init()'s dependency on any particular 'struct mtk_pinctrl'.


Remediation:
CVE: CVE-2025-7293
Component: IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:59:01.460000+00:00

IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26229.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
on-headers vulnerable to http response header manipulation
CVE: CVE-2025-7339
Component: on-headers
CWE: CWE-241
Severity: Low
CVSS v3: 4.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-07-17T15:47:39.680000+00:00

A header modification flaw has been discovered in the on-headers npm library. In specific cases, response headers may be inadvertently modified when an array is passed to `response.writeHead()`.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.20/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf
Users may work around this issue by passing an object rather than an array to the `response.writeHead()` function.
ixgbevf: fix mailbox API compatibility by negotiating supported features
CVE: CVE-2025-40104
Component: kernel
CWE: CWE-440
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ixgbevf: fix mailbox API compatibility by negotiating supported features

There was backward compatibility in the terms of mailbox API. Various
drivers from various OSes supporting 10G adapters from Intel portfolio
could easily negotiate mailbox API.

This convention has been broken since introducing API 1.4.
Commit 0062e7cc955e ("ixgbevf: add VF IPsec offload code") added support
for IPSec which is specific only for the kernel ixgbe driver. None of the
rest of the Intel 10G PF/VF drivers supports it. And actually lack of
support was not included in the IPSec implementation - there were no such
code paths. No possibility to negotiate support for the feature was
introduced along with introduction of the feature itself.

Commit 339f28964147 ("ixgbevf: Add support for new mailbox communication
between PF and VF") increasing API version to 1.5 did the same - it
introduced code supported specifically by the PF ESX driver. It altered API
version for the VF driver in the same time not touching the version
defined for the PF ixgbe driver. It led to additional discrepancies,
as the code provided within API 1.6 cannot be supported for Linux ixgbe
driver as it causes crashes.

The issue was noticed some time ago and mitigated by Jake within the commit
d0725312adf5 ("ixgbevf: stop attempting IPSEC offload on Mailbox API 1.5").
As a result we have regression for IPsec support and after increasing API
to version 1.6 ixgbevf driver stopped to support ESX MBX.

To fix this mess add new mailbox op asking PF driver about supported
features. Basing on a response determine whether to set support for IPSec
and ESX-specific enhanced mailbox.

New mailbox op, for compatibility purposes, must be added within new API
revision, as API version of OOT PF & VF drivers is already increased to
1.6 and doesn't incorporate features negotiate op.

Features negotiation mechanism gives possibility to be extended with new
features when needed in the future.


Remediation:
rv: Use strings in da monitors tracepoints
CVE: CVE-2025-38636
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rv: Use strings in da monitors tracepoints

Using DA monitors tracepoints with KASAN enabled triggers the following
warning:

 BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0
 Read of size 32 at addr ffffffffaada8980 by task ...
 Call Trace:
  <TASK>
 [...]
  do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0
  ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10
  ? trace_event_sncid+0x83/0x200
  trace_event_sncid+0x163/0x200
 [...]
 The buggy address belongs to the variable:
  automaton_snep+0x4e0/0x5e0

This is caused by the tracepoints reading 32 bytes __array instead of
__string from the automata definition. Such strings are literals and
reading 32 bytes ends up in out of bound memory accesses (e.g. the next
automaton's data in this case).
The error is harmless as, while printing the string, we stop at the null
terminator, but it should still be fixed.

Use the __string facilities while defining the tracepoints to avoid
reading out of bound memory.


Remediation:
erofs: fix invalid algorithm for encoded extents
CVE: CVE-2025-39924
Component: kernel
Severity: None
Release date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix invalid algorithm for encoded extents

The current algorithm sanity checks do not properly apply to new
encoded extents.

Unify the algorithm check with Z_EROFS_COMPRESSION(_RUNTIME)_MAX
and ensure consistency with sbi->available_compr_algs.


Remediation:
ksmbd: fix bug on trap in smb2_lock
CVE: CVE-2025-21944
Component: kernel
Severity: None
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix bug on trap in smb2_lock

If lock count is greater than 1, flags could be old value.
It should be checked with flags of smb_lock, not flags.
It will cause bug-on trap from locks_free_lock in error handling
routine.


Remediation:
YugabyteDB null pointer dereference
CVE: CVE-2025-8865
Component: yugabytedb
CWE: CWE-476
Severity: Low
CVSS v3: 2.4/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-11T14:19:02.960000+00:00

A null pointer dereference flaw has been discovered in YugabyteDB. An authenticated attacker could exploit this to crash the YCQL tablet server, resulting in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Inappropriate implementation in V8
CVE: CVE-2025-12727
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-10T20:00:55.682000+00:00

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation: