huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
CVE: CVE-2025-40187
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()

If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0
and sctp_ulpevent_make_authkey() returns 0, then the variable
ai_ev remains zero and the zero will be dereferenced
in the sctp_ulpevent_free() function.


Remediation:
MySQL Server: Denial of Service vulnerability
CVE: CVE-2025-21494
Component: mysql
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-21T20:52:53.805000+00:00

A flaw was found in MySQL Server. This vulnerability allows an unauthenticated attacker to cause a hang or frequently repeatable crash via logon to the infrastructure where MySQL Server executes.


Remediation:
CVE: CVE-2025-15061
Component: Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability
Release date: 2025-12-30T01:05:08.179000+00:00

Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the fetchWithRetry method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27877.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
usb: xhci: Fix invalid pointer dereference in Etron workaround
CVE: CVE-2025-37813
Component: kernel
CWE: CWE-68
Severity: Moderate
CVSS v3: 6.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: xhci: Fix invalid pointer dereference in Etron workaround

This check is performed before prepare_transfer() and prepare_ring(), so
enqueue can already point at the final link TRB of a segment. And indeed
it will, some 0.4% of times this code is called.

Then enqueue + 1 is an invalid pointer. It will crash the kernel right
away or load some junk which may look like a link TRB and cause the real
link TRB to be replaced with a NOOP. This wouldn't end well.

Use a functionally equivalent test which doesn't dereference the pointer
and always gives correct result.

Something has crashed my machine twice in recent days while playing with
an Etron HC, and a control transfer stress test ran for confirmation has
just crashed it again. The same test passes with this patch applied.


Remediation:
Libmodsecurity3 has possible bypass of encoded HTML entities
CVE: CVE-2025-27110
Component: mod_security
CWE: CWE-172
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Release date: 2025-02-25T20:00:44.211000+00:00

A flaw was found in the ibmodsecurity3 component of the ModSecurity project. Due to an error in handling encoding, ModSecurity cannot decode HTML entities if they contain leading zeroes. This issue may allow malicious payloads to pass through security filters in configurations relying on ModSecurity for web traffic processing.

Statement: This vulnerability exists in one specific version of libmodsecurity3 (v3.0.13). Red Hat does not ship an affected version in any products.

Remediation:
No mitigation is available for this issue other than updating the affected package to the version containing the fix.
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVE: CVE-2025-6051
Component: transformers
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-14T17:03:02.953000+00:00

A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library’s EnglishNormalizer.normalize_numbers method of the CLVP model. Maliciously crafted long numeric strings cause excessive CPU usage due to inefficient regex processing, leading to potential service disruption.

Statement: This ReDoS vulnerability is classified as a Moderate issue because, while it does not compromise confidentiality or integrity, it can significantly impact the availability of services using the affected component. Attackers can exploit this flaw by sending specially crafted long numeric inputs that cause excessive CPU consumption, potentially slowing down or crashing text processing pipelines, such as text-to-speech systems. Although it requires no special privileges or user interaction, the impact is limited to resource exhaustion rather than data theft or system takeover.

Remediation:
For mitigation, it’s recommended to implement input validation to limit the length and complexity of numeric strings processed by the EnglishNormalizer. Applying rate limiting and monitoring CPU usage can also help detect and prevent potential abuse. For services exposed to untrusted inputs, consider adding sandboxing or timeouts to avoid prolonged processing caused by malicious payloads.
thunderbird: Process isolation bypass using "javascript:" URI links in cross-origin frames
CVE: CVE-2025-4083
Component: firefox
CWE: CWE-653
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-04-29T13:13:36.578000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
net/mlx5: Fix vport QoS cleanup on error
CVE: CVE-2025-21882
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix vport QoS cleanup on error

When enabling vport QoS fails, the scheduling node was never freed,
causing a leak.

Add the missing free and reset the vport scheduling node pointer to
NULL.


Remediation:
ksmbd: prevent rename with empty string
CVE: CVE-2025-37956
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: prevent rename with empty string

Client can send empty newname string to ksmbd server.
It will cause a kernel oops from d_alloc.
This patch return the error when attempting to rename
a file or directory with an empty new name string.


Remediation:
gnuplot segmentation fault on X11_graphics
CVE: CVE-2025-31181
Component: gnuplot
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-27T00:00:00+00:00

A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.

Statement: This flaw is rated as a Moderate impact as the attacker or malicious user must be local and the impact is restricted to availability.

Remediation:
Currently, no mitigation is available for this vulnerability.
ollama: Denial of Service via GGUF decoder
CVE: CVE-2025-66959
Component: ollama
CWE: CWE-130
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in ollama. A remote attacker could exploit this vulnerability by sending specially crafted input to the GGUF decoder, leading to a Denial of Service (DoS). This issue can make the service unavailable to legitimate users.

Statement: This vulnerability is rated Moderate for Red Hat products. A remote attacker can cause a denial of service in ollama by sending a specially crafted GGUF decoder input. This affects Red Hat Ansible Automation Platform, Red Hat OpenShift AI, and Ansible Services, where ollama is utilized in various components.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata
CVE: CVE-2025-71265
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

No description is available for this CVE.


Remediation:
Disclosure of Executed Commands and Outputs in Foreman / Red Hat Satellite
CVE: CVE-2025-2157
Component: foreman
CWE: CWE-922
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-13T17:58:25.504000+00:00

A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.


Remediation:
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
CVE: CVE-2025-64437
Component: kubevirt.io/kubevirt
CWE: CWE-59
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Release date: 2025-11-07T23:04:10.913000+00:00

KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Sensitive headers shown in the HTTP access logs
CVE: CVE-2025-11537
Component: keycloak-server
CWE: CWE-117
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-10-09T19:17:00+00:00

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract these credentials (e.g., bearer tokens, session cookies) and use them to impersonate users, leading to a full account compromise.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match()
CVE: CVE-2025-40168
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-11-12T00:00:00+00:00

A flaw was found in the Linux kernel’s SMC (Shared Memory Communication) module: in smc_clc_prfx_match(), the function is called from smc_listen_work() without proper RCU or RTNL protection. The code previously used sk_dst_get(sk)->dev, which can lead to a use-after-free (UAF) condition if the sk’s destination is freed concurrently.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HDF5 Resource Consumption Vulnerability
CVE: CVE-2025-6817
Component: hdf5
CWE: CWE-404
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-06-28T11:31:05.770000+00:00

A flaw was found in hdf5. The H5C__load_entry function in HDF5 1.14.6 contains an issue that results in resource consumption when processing a specially crafted file. This flaw allows a local attacker to trigger this condition by providing the vulnerable file to the application. This manipulation can lead to excessive resource usage, potentially resulting in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()
CVE: CVE-2025-39732
Component: kernel
CWE: CWE-662
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask()

ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to
ieee80211_iterate_stations_atomic(). Note in this case the iterator is
required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does
not follow it as it might sleep. Consequently below warning is seen:

BUG: sleeping function called from invalid context at wmi.c:304
Call Trace:
 <TASK>
 dump_stack_lvl
 __might_resched.cold
 ath11k_wmi_cmd_send
 ath11k_wmi_set_peer_param
 ath11k_mac_disable_peer_fixed_rate
 ieee80211_iterate_stations_atomic
 ath11k_mac_op_set_bitrate_mask.cold

Change to ieee80211_iterate_stations_mtx() to fix this issue.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30

Statement: A flaw in ath11k allowed a sleeping operation to run in an atomic context when setting a bitrate mask, triggering “sleeping function called from invalid context” and potentially leading to a kernel oops or hang. The fix switches to the mutex-based station iterator, aligning the code with the required sleepable context. This results in a local denial of service on systems with ath11k when a privileged user configures bitrate masks.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
dnsmasq Config File util.c parse_hex heap-based overflow
CVE: CVE-2025-12198
Component: dnsmasq
CWE: CWE-131
Severity: None
CVSS v3: 0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-10-27T00:58:12.511000+00:00

A heap-based buffer overflow vulnerability in dnsmasq within the parse_hex() function of src/util.c. When parsing malformed DHCP option values in configuration files, dnsmasq miscalculates the output length and writes beyond the allocated heap buffer. This can cause a crash (Denial of Service) and, in some cases, memory corruption that may enable arbitrary code execution. The flaw is triggered during configuration parsing, so an attacker who can supply or modify the dnsmasq configuration file could exploit it.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

To reduce the risk, restrict who can write or supply dnsmasq configuration files (ensure /etc/dnsmasq.conf and any included files are owned by root and not writable by unprivileged users), remove or avoid DHCP hex option entries coming from automated or untrusted sources, and validate configuration artifacts in your deployment pipeline before they reach production. Run dnsmasq with least privilege (drop root where possible, use systemd sandboxing, chroot or seccomp), enable runtime hardening (ASLR, hardened allocators) and monitor for crashes after config changes.
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
CVE: CVE-2025-39698
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring/futex: ensure io_futex_wait() cleans up properly on failure

The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.

Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.

Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.

Statement: A flaw in io_uring’s futex path freed io_futex_data on error but left req->async_data and the REQ_F_ASYNC_DATA flag inconsistent, creating a window for use-after-free.
This issue is reachable by any unprivileged local user via io_uring futex operations. The most plausible impact is denial of service, since the freed structure is small and not directly attacker-controlled, making exploitation for privilege escalation very unlikely. Still, as with any use-after-free in kernel space, a worst-case impact would be privileges escalation.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: wwan: t7xx: Fix napi rx poll issue
CVE: CVE-2025-38123
Component: kernel
Severity: None
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: t7xx: Fix napi rx poll issue

When driver handles the napi rx polling requests, the netdev might
have been released by the dellink logic triggered by the disconnect
operation on user plane. However, in the logic of processing skb in
polling, an invalid netdev is still being used, which causes a panic.

BUG: kernel NULL pointer dereference, address: 00000000000000f1
Oops: 0000 [#1] PREEMPT SMP NOPTI
RIP: 0010:dev_gro_receive+0x3a/0x620
[...]
Call Trace:
 <IRQ>
 ? __die_body+0x68/0xb0
 ? page_fault_oops+0x379/0x3e0
 ? exc_page_fault+0x4f/0xa0
 ? asm_exc_page_fault+0x22/0x30
 ? __pfx_t7xx_ccmni_recv_skb+0x10/0x10 [mtk_t7xx (HASH:1400 7)]
 ? dev_gro_receive+0x3a/0x620
 napi_gro_receive+0xad/0x170
 t7xx_ccmni_recv_skb+0x48/0x70 [mtk_t7xx (HASH:1400 7)]
 t7xx_dpmaif_napi_rx_poll+0x590/0x800 [mtk_t7xx (HASH:1400 7)]
 net_rx_action+0x103/0x470
 irq_exit_rcu+0x13a/0x310
 sysvec_apic_timer_interrupt+0x56/0x90
 </IRQ>


Remediation:
spi: cs42l43: Property entry should be a null-terminated array
CVE: CVE-2025-38573
Component: kernel
CWE: CWE-170
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spi: cs42l43: Property entry should be a null-terminated array

The software node does not specify a count of property entries, so the
array must be null-terminated.

When unterminated, this can lead to a fault in the downstream cs35l56
amplifier driver, because the node parse walks off the end of the
array into unknown memory.


Remediation:
thunderbird: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
CVE: CVE-2025-0243
Component: firefox
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-07T16:07:07.372000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Heap buffer over-read in `skip_insignificant_space` when sniffing content
CVE: CVE-2025-2784
Component: libsoup
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.9/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-03-25T00:00:00+00:00

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

Statement: Red Hat rates this with a Moderate impact as the flaw may be targeting Confidentiality and Integrity specific to each request.

Remediation:
Currently no mitigation is available for this vulnerability.
erofs: fix crafted invalid cases for encoded extents
CVE: CVE-2025-40241
Component: kernel
Severity: None
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix crafted invalid cases for encoded extents

Robert recently reported two corrupted images that can cause system
crashes, which are related to the new encoded extents introduced
in Linux 6.15:

  - The first one [1] has plen != 0 (e.g. plen == 0x2000000) but
    (plen & Z_EROFS_EXTENT_PLEN_MASK) == 0. It is used to represent
    special extents such as sparse extents (!EROFS_MAP_MAPPED), but
    previously only plen == 0 was handled;

  - The second one [2] has pa 0xffffffffffdcffed and plen 0xb4000,
    then "cur [0xfffffffffffff000] += bvec.bv_len [0x1000]" in
    "} while ((cur += bvec.bv_len) < end);" wraps around, causing an
    out-of-bound access of pcl->compressed_bvecs[] in
    z_erofs_submit_queue().  EROFS only supports 48-bit physical block
    addresses (up to 1EiB for 4k blocks), so add a sanity check to
    enforce this.


Remediation: