huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE: CVE-2025-10921
Component: gimp
CWE: CWE-122
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-10-29T19:29:39.135000+00:00

A heap-based buffer-overflow in GIMP’s HDR (RGBE) file parsing (CVE-2025-10921 / ZDI-25-910) allows an attacker to execute arbitrary code when a user opens or is tricked into previewing a malicious HDR file. The flaw is caused by missing length validation before copying user-supplied HDR data into a heap buffer, enabling memory corruption and control of program flow.

Statement: This vulnerability is Important because it enables remote code execution in the context of the user’s GIMP process with relatively low prerequisites: an attacker only needs to supply a crafted HDR file and get the victim to open or preview it. Heap overflows in image-parsing code are especially dangerous because image loaders commonly operate on untrusted files and often run in the same process as the application’s UI and plugins; a successful overwrite of heap metadata or adjacent control data can lead to arbitrary instruction-pointer control (RCE). Although exploitation requires user interaction (opening/preview), the attack surface is large (attachments, downloads, web previews) and the payload can execute with the user’s privileges, potentially leading to system compromise or lateral movement if the user has elevated access.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
CVE: CVE-2025-6640
Component: PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability
Release date: 2025-06-25T21:32:12.158000+00:00

PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26527.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2025-43440
Component: webkitgtk
CWE: CWE-20
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-20T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause JIT issues due to improper checks and result in an unexpected process crash.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification
CVE: CVE-2025-47950
Component: coredns
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-06-06T17:32:30.218000+00:00

A memory exhaustion vulnerability was found in CoreDNS when operating with QUIC traffic streams. The CoreDNS server in affected versions would spawn a new goroutine for each incoming QUIC stream without limit. This flaw allows a malicious user to create an unbounded number of QUIC streams and consume all available resources, leading to an application level denial of service.

Statement: On a Red Hat system, a denial of service to the CoreDNS service will not take down the host system, so the availability impact is assessed as Low for Red Hat systems.

Remediation:
For release note details, see the upstream Submariner release notes:

https://submariner.io/community/releases/

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/
For release note details, see the upstream Submariner release notes:

https://submariner.io/community/releases/

Downstream-specific issues resolved:

* ACM-18625

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/
Users unable to upgrade should manually disable the QUIC protocol support.
Path Traversal in llama_index
CVE: CVE-2025-6210
Component: llama-index
CWE: CWE-22
Severity: Moderate
CVSS v3: 3.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-07-07T09:55:46.893000+00:00

A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The vulnerability arises from inadequate handling of hardlinks in the load_data() method, where the security checks fail to differentiate between real files and hardlinks. This issue is resolved in version 0.5.2.

Statement: On RedHat systems most users are not given access to sensitive files. A compromised process using llama index will not have access to general system secrets unless it has been given greater permission than it should have.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
team: Move team device type change at the end of team_port_add
CVE: CVE-2025-68340
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-12-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

team: Move team device type change at the end of team_port_add

Attempting to add a port device that is already up will expectedly fail,
but not before modifying the team device header_ops.

In the case of the syzbot reproducer the gre0 device is
already in state UP when it attempts to add it as a
port device of team0, this fails but before that
header_ops->create of team0 is changed from eth_header to ipgre_header
in the call to team_dev_type_check_change.

Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense
as the private data of the device still holds a struct team.

Example sequence of iproute2 commands to reproduce the hang/BUG():
ip link add dev team0 type team
ip link add dev gre0 type gre
ip link set dev gre0 up
ip link set dev gre0 master team0
ip link set dev team0 up
ping -I team0 1.1.1.1

Move team_dev_type_check_change down where all other checks have passed
as it changes the dev type with no way to restore it in case
one of the checks that follow it fail.

Also make sure to preserve the origial mtu assignment:
  - If port_dev is not the same type as dev, dev takes mtu from port_dev
  - If port_dev is the same type as dev, port_dev takes mtu from dev

This is done by adding a conditional before the call to dev_set_mtu
to prevent it from assigning port_dev->mtu = dev->mtu and instead
letting team_dev_type_check_change assign dev->mtu = port_dev->mtu.
The conditional is needed because the patch moves the call to
team_dev_type_check_change past dev_set_mtu.

Testing:
  - team device driver in-tree selftests
  - Add/remove various devices as slaves of team device
  - syzbot


Remediation:
dm-verity: disable recursive forward error correction
CVE: CVE-2025-71161
Component: kernel
CWE: CWE-835
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A denial-of-service vulnerability was found in the Linux kernel's dm-verity device mapper target. The recursive forward error correction (FEC) implementation allows up to 253^4 (approximately 4 billion) iterations due to nested recursion in fec_read_bufs() and verity_hash_for_block(). A specially crafted dm-verity image can trigger this worst-case behavior, causing the udev-worker process to become stuck in uninterruptible sleep state.

Statement: This vulnerability was discovered by the Red Hat QE team who created a dm-verity image that triggers the maximum recursion depth. The resulting denial of service causes system processes to hang in D state, affecting system responsiveness. Additionally, the recursive FEC is fundamentally broken as the shared fio->bufs buffer gets overwritten during recursion. Local access to create or mount dm-verity images is required.

Remediation:
FFmpeg: Use-after-free vulnerability in SANM decoding
CVE: CVE-2025-59734
Component: FFmpeg
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-06T08:09:44.280000+00:00

A flaw was found in FFmpeg. This vulnerability allows a use-after-free write and read via a carefully crafted animation file during SANM (Scaleable Adaptive Network Management) decoding.

Statement: The highest threat of this use-after-free vulnerability in FFmpeg's SANM decoding is to system availability. An attacker on the same network segment could trigger a denial of service by providing a specially crafted animation file, potentially corrupting memory allocator metadata.

Remediation:
aiohttp: Denial of Service via memory exhaustion from crafted POST request
CVE: CVE-2025-69228
Component: aiohttp
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in aiohttp. A remote attacker can craft a malicious request that, when processed by an aiohttp server using the `Request.post()` method, causes the server's memory to fill uncontrollably. This can lead to a Denial of Service (DoS) by freezing the server, making it unavailable to legitimate users.

Statement: This vulnerability is rated Moderate for Red Hat products. A flaw in aiohttp allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted POST request to an aiohttp server that utilizes the `Request.post()` method. This can lead to uncontrolled memory consumption, freezing the server and making the server unavailable.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure
CVE: CVE-2025-40145
Component: kernel
Severity: None
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI/pwrctrl: Fix double cleanup on devm_add_action_or_reset() failure

When devm_add_action_or_reset() fails, it calls the passed cleanup
function.  Hence the caller must not repeat that cleanup.

Replace the "goto err_regulator_free" by the actual freeing, as there
will never be a need again for a second user of this label.


Remediation:
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
CVE: CVE-2025-39965
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

x->id.spi == 0 means "no SPI assigned", but since commit
94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states
and add them to the byspi list with this value.

__xfrm_state_delete doesn't remove those states from the byspi list,
since they shouldn't be there, and this shows up as a UAF the next
time we go through the byspi list.

Statement: In XFRM state management, xfrm_alloc_spi() treated SPI 0 as a usable value and inserted such states into the byspi list. Since SPI 0 semantically means “no SPI assigned,” subsequent delete paths did not unlink these entries, leaving stale list nodes. Iteration over byspi could then access freed memory, leading to a use-after-free and kernel crash.

Remediation:
To mitigate this issue, prevent module xfrm_user from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Inappropriate implementation in Picture In Picture in Google Chrome
CVE: CVE-2025-8577
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-08-07T01:30:38.705000+00:00

A flaw was found in the Picture-in-Picture component of Google Chrome. This vulnerability allows a remote attacker who convinces a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
f2fs: fix to avoid out-of-boundary access in dnode page
CVE: CVE-2025-38677
Component: kernel
Severity: None
Release date: 2025-08-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid out-of-boundary access in dnode page

As Jiaming Zhang reported:

 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x17e/0x800 mm/kasan/report.c:480
 kasan_report+0x147/0x180 mm/kasan/report.c:593
 data_blkaddr fs/f2fs/f2fs.h:3053 [inline]
 f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline]
 f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855
 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195
 prepare_write_begin fs/f2fs/data.c:3395 [inline]
 f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594
 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112
 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline]
 f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x546/0xa90 fs/read_write.c:686
 ksys_write+0x149/0x250 fs/read_write.c:738
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The root cause is in the corrupted image, there is a dnode has the same
node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to
access block address in dnode at offset 934, however it parses the dnode
as inode node, so that get_dnode_addr() returns 360, then it tries to
access page address from 360 + 934 * 4 = 4096 w/ 4 bytes.

To fix this issue, let's add sanity check for node id of all direct nodes
during f2fs_get_dnode_of_data().


Remediation:
usb: typec: ucsi: displayport: Fix NULL pointer access
CVE: CVE-2025-37994
Component: kernel
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix NULL pointer access

This patch ensures that the UCSI driver waits for all pending tasks in the
ucsi_displayport_work workqueue to finish executing before proceeding with
the partner removal.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
LibTIFF memory corruption
CVE: CVE-2025-8961
Component: libtiff
CWE: CWE-119
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-14T12:02:08.516000+00:00

A memory corruption flaw was found in libTIFF. This issue affects the  May function of the tiffcrop.c file in the tiffcrop component. This attack needs to be approached locally.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header
CVE: CVE-2025-21840
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

thermal/netlink: Prevent userspace segmentation fault by adjusting UAPI header

The intel-lpmd tool [1], which uses the THERMAL_GENL_ATTR_CPU_CAPABILITY
attribute to receive HFI events from kernel space, encounters a
segmentation fault after commit 1773572863c4 ("thermal: netlink: Add the
commands and the events for the thresholds").

The issue arises because the THERMAL_GENL_ATTR_CPU_CAPABILITY raw value
was changed while intel_lpmd still uses the old value.

Although intel_lpmd can be updated to check the THERMAL_GENL_VERSION and
use the appropriate THERMAL_GENL_ATTR_CPU_CAPABILITY value, the commit
itself is questionable.

The commit introduced a new element in the middle of enum thermal_genl_attr,
which affects many existing attributes and introduces potential risks
and unnecessary maintenance burdens for userspace thermal netlink event
users.

Solve the issue by moving the newly introduced
THERMAL_GENL_ATTR_TZ_PREV_TEMP attribute to the end of the
enum thermal_genl_attr. This ensures that all existing thermal generic
netlink attributes remain unaffected.

[ rjw: Subject edits ]


Remediation:
vim memmove-vec-unaligned-erms.S __memmove_avx_unaligned_erms memory corruption
CVE: CVE-2025-9389
Component: vim
CWE: CWE-119
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-24T13:02:07.721000+00:00

A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms.S. The manipulation leads to memory corruption. The attack needs to be performed locally. The exploit is publicly available and might be used. Some users are not able to reproduce this. One of the users mentions that this appears not to be working, "when coloring is turned on".

Statement: A memory corruption vulnerability exists in the Vim text editor's __memmove_avx_unaligned_erms() function (memmove-vec-unaligned-erms.S file). This issue can be triggered by a local attacker with low privileges who convinces a user to open a specially crafted file. Exploitation of this flaw leads to an application crash, resulting in a denial of service (DoS) that impacts system Availability.

Remediation:
At the time of this analysis, an official patch has not been released. Users should upgrade to vim-9.1.0000 or the latest version.
CVE: CVE-2025-0901
Component: PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-01-31T22:06:24.159000+00:00

PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25372.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Open Redirect
CVE: CVE-2025-12789
Component: rhsso
CWE: CWE-601
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-11-06T00:00:00+00:00

A flaw was found in Red Hat Single Sign-On. This issue is an Open Redirect vulnerability that occurs during the logout process. The redirect_uri parameter associated with the openid-connect logout protocol does not properly validate the provided URL.

Statement: Red Hat Single Sign-On is on end of life. This affects only 7.3.33 and previous versions.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick vulnerable to denial of service via integer overflow in BMP decoder on 32-bit systems
CVE: CVE-2025-62171
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 4.9/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-10-17T16:30:27.144000+00:00

A vulnerability for an integer overflow has been identified in the ImageMagick image processing software suite on 32-bit systems with non-default resource limits. An attacker can exploit this flaw by providing a specially crafted malicious image file (BMP format) for processing. Successful exploitation leads to an out-of-bounds write, which could result in a denial of service by crashing the application.

Statement: This vulnerability is rated Moderate for Red Hat because it only affects 32-bit builds of ImageMagick. Exploitation requires that default resource limits for image processing (width, height, and area) have been manually increased beyond their defaults. Red Hat Enterprise Linux systems running 64-bit builds of ImageMagick or using default resource limits are not affected.

Remediation:
To mitigate this issue, ensure that ImageMagick is configured with its default resource limits for image width, height, and area. Avoid manually increasing these limits beyond their defaults, especially on 32-bit systems. If 32-bit ImageMagick is not a requirement, deploying 64-bit versions of ImageMagick will prevent this vulnerability.