huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
thunderbird: Use-after-free triggered by XSLTProcessor
CVE: CVE-2025-3028
Component: firefox
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2025-04-01T12:28:58.303000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Unsanitized address book fields
CVE: CVE-2025-1015
Component: thunderbird
CWE: CWE-601
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-02-04T13:58:56.867000+00:00

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the "Other" field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird and that page could execute (unprivileged) JavaScript.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
GNU Binutils ld libbfd.c bfd_malloc memory leak
CVE: CVE-2025-1150
Component: binutils
CWE: CWE-772
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-02-10T16:31:07.343000+00:00

A flaw was found in the ld linker utility of GNU Binutils. A specially-crafted payload may be able to trigger a memory leak, which can lead to an application crash or other undefined behavior.


Remediation:
CVE: CVE-2025-7987
Component: Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
Release date: 2025-07-22T18:00:31.788000+00:00

Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25756.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
platform/x86/amd: pmf: Use device managed allocations
CVE: CVE-2025-38421
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd: pmf: Use device managed allocations

If setting up smart PC fails for any reason then this can lead to
a double free when unloading amd-pmf.  This is because dev->buf was
freed but never set to NULL and is again freed in amd_pmf_remove().

To avoid subtle allocation bugs in failures leading to a double free
change all allocations into device managed allocations.


Remediation:
Namespace Use-After-Free in xmlSetTreeDoc() function of libxml2
CVE: CVE-2025-12863
Component: libxml2
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-07T00:00:00+00:00

A flaw was found in the xmlSetTreeDoc() function of the libxml2 XML parsing library. This function is responsible for updating document pointers when XML nodes are moved between documents. Due to improper handling of namespace references, a namespace pointer may remain linked to a freed memory region when the original document is destroyed. As a result, subsequent operations that access the namespace can lead to a use-after-free condition, causing an application crash.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as High, given that it can be remotely triggered through crafted XML content without authentication or user interaction. Successful exploitation allows attackers to crash services or applications that rely on libxml2 for XML document manipulation or serialization.

Remediation:
ntfs3: pretend $Extend records as regular files
CVE: CVE-2025-40313
Component: kernel
Severity: None
Release date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: pretend $Extend records as regular files

Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()")
requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/
S_IFIFO/S_IFSOCK type, use S_IFREG for $Extend records.


Remediation:
x86/mm: Check return value from memblock_phys_alloc_range()
CVE: CVE-2025-38071
Component: kernel
CWE: CWE-253
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/mm: Check return value from memblock_phys_alloc_range()

At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of
contiguous free memory available at this point, the kernel will crash
and burn because memblock_phys_alloc_range() returns 0 on failure,
which leads memblock_phys_free() to throw the first 4 MiB of physical
memory to the wolves.

At a minimum it should fail gracefully with a meaningful diagnostic,
but in fact everything seems to work fine without the weird reserve
allocation.


Remediation:
Werkzeug: Denial of service via Windows device names in path segments
CVE: CVE-2025-66221
Component: Werkzeug
CWE: CWE-67
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-29T02:28:34.524000+00:00

A flaw was found in Werkzeug. This vulnerability allows a denial of service via path segments with Windows device names.

Statement: This vulnerability is not applicable to Red Hat products as it specifically affects applications running on Microsoft Windows operating systems. The flaw in Werkzeug's `safe_join` function, which allows denial of service via Windows device names in path segments, does not manifest in Linux environments.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
iperf Authentication Decode Failure
CVE: CVE-2025-54350
Component: iperf3
CWE: CWE-617
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-03T00:00:00+00:00

A flaw was found in iperf3. A malformed Base64-encoded authentication string triggers an assertion failure within the `iperf_auth.c` file, leading to application termination. This vulnerability allows a network attacker to induce this failure by sending a crafted authentication attempt, resulting in an application-level denial of service condition.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
xwayland: Buffer overflow in XkbVModMaskText()
CVE: CVE-2025-26595
Component: Xorg
CWE: CWE-121
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-25T00:00:00+00:00

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity and are not affected by this bug.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
gnuplot segmentation fault on xstrftime
CVE: CVE-2025-31179
Component: gnuplot
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-27T00:00:00+00:00

A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.

Statement: This flaw is rated as a Moderate impact as the attacker or malicious user must be local and the impact is restricted to availability.

Remediation:
Currently, no mitigation is available for this vulnerability
appneta tcpreplay send_packets.c calc_sleep_time divide by zero
CVE: CVE-2025-9649
Component: tcpreplay
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-08-29T13:32:07.505000+00:00

A flaw was found in tcpreplay. A division-by-zero issue can be triggered when processing malformed Packets Per Second (PPS) parameters, particularly with extremely small packet rate values, which causes a floating-point exception and results in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
tomcat: Apache Tomcat: session fixation via rewrite valve
CVE: CVE-2025-55668
Component: org.apache.tomcat/tomcat-catalina
CWE: CWE-384
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-08-13T13:21:35.743000+00:00

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will occur within the context of the attacker's session. This could allow an attacker to hijack the victim's session and perform actions on their behalf.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing Red Hat JBoss Web Server installation, including all applications and configuration files.

The References section of this erratum contains a download link for the update. You must be logged in to download the update.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
io_uring: always do atomic put from iowq
CVE: CVE-2025-37804
Component: kernel
CWE: CWE-362
Severity: None
CVSS v3: 0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-05-08T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:
io_uring: always do atomic put from iowq

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025052019-REJECTED-02e4@gregkh/

Remediation:
Double free in glibc
CVE: CVE-2025-8058
Component: glibc
CWE: CWE-415
Severity: Moderate
CVSS v3: 4.2/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-07-23T19:57:17.138000+00:00

A double-free vulnerability has been discovered in glibc (GNU C Library). This flaw occurs during bracket expression parsing within the regcomp function, specifically when a memory allocation failure takes place. Exploitation of a double-free vulnerability can lead to memory corruption, which could enable an attacker to achieve arbitrary code execution or a denial of service condition.


Remediation:
The container images provided by this update can be downloaded from the
Red Hat container registry at registry.redhat.io using the "podman pull" command.
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat Insights proxy product RPM.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ext4: guard against EA inode refcount underflow in xattr update
CVE: CVE-2025-40190
Component: kernel
CWE: CWE-191
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: guard against EA inode refcount underflow in xattr update

syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA
inode refcount that is already <= 0 and then applies ref_change (often
-1). That lets the refcount underflow and we proceed with a bogus value,
triggering errors like:

  EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1
  EXT4-fs warning: ea_inode dec ref err=-117

Make the invariant explicit: if the current refcount is non-positive,
treat this as on-disk corruption, emit ext4_error_inode(), and fail the
operation with -EFSCORRUPTED instead of updating the refcount. Delete the
WARN_ONCE() as negative refcounts are now impossible; keep error reporting
in ext4_error_inode().

This prevents the underflow and the follow-on orphan/cleanup churn.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
CVE: CVE-2025-23144
Component: kernel
CWE: CWE-413
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()

Lockdep detects the following issue on led-backlight removal:
  [  142.315935] ------------[ cut here ]------------
  [  142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80
  ...
  [  142.500725] Call trace:
  [  142.503176]  led_sysfs_enable+0x54/0x80 (P)
  [  142.507370]  led_bl_remove+0x80/0xa8 [led_bl]
  [  142.511742]  platform_remove+0x30/0x58
  [  142.515501]  device_remove+0x54/0x90
  ...

Indeed, led_sysfs_enable() has to be called with the led_access
lock held.

Hold the lock when calling led_sysfs_disable().


Remediation:
Chromium use after free
CVE: CVE-2025-7657
Component: chromium-browser
CVSS v3: 7.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-07-15T18:12:37.091000+00:00

Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drbd: add missing kref_get in handle_write_conflicts
CVE: CVE-2025-38708
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drbd: add missing kref_get in handle_write_conflicts

With `two-primaries` enabled, DRBD tries to detect "concurrent" writes
and handle write conflicts, so that even if you write to the same sector
simultaneously on both nodes, they end up with the identical data once
the writes are completed.

In handling "superseeded" writes, we forgot a kref_get,
resulting in a premature drbd_destroy_device and use after free,
and further to kernel crashes with symptoms.

Relevance: No one should use DRBD as a random data generator, and apparently
all users of "two-primaries" handle concurrent writes correctly on layer up.
That is cluster file systems use some distributed lock manager,
and live migration in virtualization environments stops writes on one node
before starting writes on the other node.

Which means that other than for "test cases",
this code path is never taken in real life.

FYI, in DRBD 9, things are handled differently nowadays.  We still detect
"write conflicts", but no longer try to be smart about them.
We decided to disconnect hard instead: upper layers must not submit concurrent
writes. If they do, that's their fault.


Remediation:
CVE: CVE-2025-11465
Component: Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2025-10-16T17:50:04.432000+00:00

Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26631.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
MySQL Server: Denial of service vulnerability via network access
CVE: CVE-2025-21529
Component: mysql
CWE: CWE-617
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:53:07.906000+00:00

A flaw was found in MySQL Server. This vulnerability allows a high privileged attacker to cause a complete denial of service (DoS) via network access using multiple protocols.


Remediation:
mruby Heap Buffer Overflow
CVE: CVE-2025-7207
Component: mruby
CWE: CWE-787
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-09T00:02:07.237000+00:00

A flaw was found in mruby. The `scope_new` function in `mrbgems/mruby-compiler/core/codegen.c` contains a heap-based buffer manipulation, potentially leading to memory corruption. A local attacker can trigger this vulnerability through crafted input, resulting in a potential denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Google Chrome: Sandbox escape via use-after-free in Password Manager
CVE: CVE-2025-14372
Component: Google Chrome
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-12-12T19:20:42.308000+00:00

Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick: Denial of Service via circular references in MVG files
CVE: CVE-2025-68950
Component: ImageMagick
CWE: CWE-674
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-30T16:50:25.773000+00:00

A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. ImageMagick fails to check for circular references between two Magick Vector Graphics (MVG) files. A remote attacker could exploit this by providing a specially crafted MVG file, leading to a stack overflow and causing a Denial of Service (DoS) condition.

Statement: This vulnerability is rated Moderate for Red Hat products. The flaw in ImageMagick allows a denial of service via a stack overflow when processing specially crafted Magick Vector Graphics (MVG) files with circular references. Exploitation requires an attacker to provide a malicious MVG file to a system using ImageMagick.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted Magick Vector Graphics (MVG) files with ImageMagick. For deployments where ImageMagick processes external or untrusted content, consider implementing sandboxing or resource limiting mechanisms to contain potential Denial of Service impacts.