huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
LIBPNG heap buffer overflow via malformed palette index
CVE: CVE-2025-64505
Component: libpng
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2025-11-24T23:38:40.405000+00:00

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.

Statement: This vulnerability is rated Moderate for Red Hat products. It affects applications that process specially crafted PNG files using the vulnerable `libpng` library. Exploitation requires user interaction, where a victim must open or process a malicious PNG image, leading to a heap buffer over-read. This could result in information disclosure or application crash.

java-*-openjdk-headless packages do not contain libsplashscreen.so, hence are not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Out-of-Bounds Read in Poppler
CVE: CVE-2025-32365
Component: poppler
CWE: CWE-125
Severity: Moderate
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-04-05T00:00:00+00:00

A flaw was found in Poppler. This vulnerability allows out-of-bounds reads via crafted input files that trigger the JBIG2Bitmap::combine function due to a misplaced isOk check.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
OFFIS DCMTK: Remote memory corruption vulnerability
CVE: CVE-2025-14607
Component: dcmtk
CVSS v3: 6.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-12-13T13:02:07.302000+00:00

A flaw was found in OFFIS DCMTK (Digital Imaging and Communications in Medicine Toolkit). This vulnerability allows memory corruption via a remote attack.

Statement: This vulnerability is rated Moderate for Red Hat products. A memory corruption flaw exists in the `DcmByteString::makeDicomByteString` function of the `dcmdata` component in OFFIS DCMTK. This issue can be exploited remotely when processing specially crafted DICOM data, potentially leading to information disclosure, data integrity issues, or denial of service.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
wifi: ath12k: fix invalid access to memory
CVE: CVE-2025-38292
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix invalid access to memory

In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean
is_continuation is part of rxcb.
Currently, after freeing the skb, the rxcb->is_continuation accessed
again which is wrong since the memory is already freed.
This might lead use-after-free error.

Hence, fix by locally defining bool is_continuation from rxcb,
so that after freeing skb, is_continuation can be used.

Compile tested only.

Statement: This patch addresses a use-after-free vulnerability in the ath12k_dp_rx_msdu_coalesce() function, where memory was accessed after freeing the associated skb. Specifically, the rxcb->is_continuation field was read post-free, leading to potential kernel crashes. The patch stores the value before freeing the buffer. The Required Privileges for CVSS is Low (PR:L), because triggering this flaw likely requires the ability to inject or manipulate network traffic handled by the Wi-Fi driver, which is feasible from a local user space process using standard socket interfaces or crafted packets.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module ath12k from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
CVE: CVE-2025-7267
Component: IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:57:49.828000+00:00

IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26179.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
xen: Add support for XenServer 6.1 platform device
CVE: CVE-2025-38046
Component: kernel
Severity: None
Release date: 2025-06-18T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
Buffer Overflow and Potential Code Execution in Radare2
CVE: CVE-2025-1864
Component: radare2
CVSS v3: 7.3/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-03-03T08:15:17.335000+00:00

A flaw was found in radare2. This vulnerability allows buffer overflow via improper restriction of operations within the bounds of a memory buffer.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
NFSD: Fix crash in nfsd4_read_release()
CVE: CVE-2025-40324
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix crash in nfsd4_read_release()

When tracing is enabled, the trace_nfsd_read_done trace point
crashes during the pynfs read.testNoFh test.


Remediation:
sctp: sysctl: udp_port: avoid using current->nsproxy
CVE: CVE-2025-21637
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sctp: sysctl: udp_port: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net'
structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only
  from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops'
  (null-ptr-deref), e.g. when the current task is exiting, as spotted by
  syzbot [1] using acct(2).

The 'net' structure can be obtained from the table->data using
container_of().

Note that table->data could also be used directly, but that would
increase the size of this fix, while 'sctp.ctl_sock' still needs to be
retrieved from 'net' structure.


Remediation:
NFC: nci: uart: Set tty->disc_data only in success path
CVE: CVE-2025-38416
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFC: nci: uart: Set tty->disc_data only in success path

Setting tty->disc_data before opening the NCI device means we need to
clean it up on error paths.  This also opens some short window if device
starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded
(broken hardware?).  Close the window by exposing tty->disc_data only on
the success path, when opening of the NCI device and try_module_get()
succeeds.

The code differs in error path in one aspect: tty->disc_data won't be
ever assigned thus NULL-ified.  This however should not be relevant
difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().


Remediation:
Keycloak: Improper Access Control in Admin REST API leads to information disclosure
CVE: CVE-2025-14083
Component: keycloak-server
CWE: CWE-284
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-12-05T00:00:00+00:00

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control.

Statement: Red Hat rates this as Low because the vulnerability allows a low-privileged user with 'create-client' permission to access internal user profile schema data, which is considered information disclosure. While this exposure of backend schema and rules could potentially be leveraged for targeted attacks or privilege escalation, it does not directly lead to immediate compromise of user accounts or system integrity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
bpf: account for current allocated stack depth in widen_imprecise_scalars()
CVE: CVE-2025-68208
Component: kernel
CWE: CWE-805
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

An out-of-bounds access vulnerability was found in the BPF verifier in the Linux kernel. The widen_imprecise_scalars() function compares verifier states with different allocated stack depths without bounds checking. This can cause out-of-bounds stack array access when the ancestor state has larger stack allocation than the current state.

Statement: Exploiting this requires loading BPF programs with specific verifier state patterns. CAP_BPF or equivalent privileges are needed to load BPF programs, limiting the attack surface.

Remediation:
CVE: CVE-2025-5827
Component: Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-06-11T17:27:25.163000+00:00

Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ble_process_esp32_msg function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-26369.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
btrfs: always detect conflicting inodes when logging inode refs
CVE: CVE-2025-71183
Component: kernel
CWE: CWE-168
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's Btrfs filesystem log replay mechanism. After performing a rename exchange operation on two directories followed by an fsync and power failure, the log tree may contain incomplete inode information. During log replay, Btrfs incorrectly attempts to delete a directory that was never deleted, and if that directory contains a subvolume, the mount fails with a transaction abort because the replay code cannot handle directory entries pointing to root items.

Statement: This vulnerability requires a specific sequence: rename exchange of directories (one containing a subvolume), fsync, and power failure. The result is filesystem mount failure after recovery, not data corruption or code execution. Impact is denial of service requiring manual filesystem repair. The complexity of triggering this issue in practice is moderate.

Remediation:
Denial of Service in CGI::Cookie.parse
CVE: CVE-2025-27219
Component: CGI
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-03T00:00:00+00:00

A flaw was found in Ruby's CGI gem. Processing specially crafted large cookies with the CGI::Cookie.parse method can cause excessive resource consumption due to a missing limit on the length of the raw cookie value, resulting in a denial of service.

Statement: This issue will cause an excessive resource consumption, potentially resulting in a bad application performance. However, an attacker does have the ability to completely deny service to legitimate users. For this reason, this vulnerability has been rated with a moderate severity.

Remediation:
Do not process large cookies or strings with the CGI::Cookie.parse method from the CGI library. Adding a check to verify and limit the length of the cookie or string before processing it will mitigate this vulnerability.
media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval
CVE: CVE-2025-39712
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval

Getting / Setting the frame interval using the V4L2 subdev pad ops
get_frame_interval/set_frame_interval causes a deadlock, as the
subdev state is locked in the [1] but also in the driver itself.

In [2] it's described that the caller is responsible to acquire and
release the lock in this case. Therefore, acquiring the lock in the
driver is wrong.

Remove the lock acquisitions/releases from mt9m114_ifp_get_frame_interval()
and mt9m114_ifp_set_frame_interval().

[1] drivers/media/v4l2-core/v4l2-subdev.c - line 1129
[2] Documentation/driver-api/media/v4l2-subdev.rst


Remediation:
Improper Access Control in Lightspeed History Management Allows Local Privilege Manipulation
CVE: CVE-2025-5962
Component: rhel-lightspeed
CWE: CWE-284
Severity: Moderate
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-06-10T00:00:00+00:00

A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication  calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.

Statement: The Red Hat Product Security team assesses the severity of this vulnerability as Moderate, despite a CVSS v3.1 base score of 7.7. The issue is limited to local exploitation and does not require elevated privileges, making it accessible to any standard user on the system. Successful exploitation allows unauthorized access and manipulation of another user's chat history, potentially leading to exposure of sensitive data or injection of misleading commands. However, the impact is constrained to multi-user environments and does not affect remote systems or cause service disruption.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria, which include ease of use and deployment, applicability to a widespread installation base, and system stability.
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
CVE: CVE-2025-38103
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

Update struct hid_descriptor to better reflect the mandatory and
optional parts of the HID Descriptor as per USB HID 1.11 specification.
Note: the kernel currently does not parse any optional HID class
descriptors, only the mandatory report descriptor.

Update all references to member element desc[0] to rpt_desc.

Add test to verify bLength and bNumDescriptors values are valid.

Replace the for loop with direct access to the mandatory HID class
descriptor member for the report descriptor. This eliminates the
possibility of getting an out-of-bounds fault.

Add a warning message if the HID descriptor contains any unsupported
optional HID class descriptors.


Remediation:
Inappropriate implementation in Media Stream
CVE: CVE-2025-1921
Component: chromium
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-03-05T03:48:37.204000+00:00

Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about a peripheral via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap Overflow in iniparser.c
CVE: CVE-2025-0633
Component: iniparser
CWE: CWE-122
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-02-19T07:01:22.478000+00:00

A flaw was found in iniparser. This vulnerability allows an attacker to read out-of-bound memory via iniparser_dumpsection_ini().


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Inappropriate implementation in Permissions
CVE: CVE-2025-12911
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-11-07T23:23:39.451000+00:00

Inappropriate implementation in Permissions in Google Chrome allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-8653
Component: Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-08-06T01:14:20.200000+00:00

Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the JKRadioService. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26312.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/sched: Restrict conditions for adding duplicating netems to qdisc tree
CVE: CVE-2025-38553
Component: kernel
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: Restrict conditions for adding duplicating netems to qdisc tree

netem_enqueue's duplication prevention logic breaks when a netem
resides in a qdisc tree with other netems - this can lead to a
soft lockup and OOM loop in netem_dequeue, as seen in [1].
Ensure that a duplicating netem cannot exist in a tree with other
netems.

Previous approaches suggested in discussions in chronological order:

1) Track duplication status or ttl in the sk_buff struct. Considered
too specific a use case to extend such a struct, though this would
be a resilient fix and address other previous and potential future
DOS bugs like the one described in loopy fun [2].

2) Restrict netem_enqueue recursion depth like in act_mirred with a
per cpu variable. However, netem_dequeue can call enqueue on its
child, and the depth restriction could be bypassed if the child is a
netem.

3) Use the same approach as in 2, but add metadata in netem_skb_cb
to handle the netem_dequeue case and track a packet's involvement
in duplication. This is an overly complex approach, and Jamal
notes that the skb cb can be overwritten to circumvent this
safeguard.

4) Prevent the addition of a netem to a qdisc tree if its ancestral
path contains a netem. However, filters and actions can cause a
packet to change paths when re-enqueued to the root from netem
duplication, leading us to the current solution: prevent a
duplicating netem from inhabiting the same tree as other netems.

[1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/
[2] https://lwn.net/Articles/719297/

Statement: A flaw in netem’s duplication-prevention logic allowed a duplicating netem to coexist with other netems in the same qdisc tree, which could trigger recursive re-enqueueing and lead to soft lockups and OOM conditions. The fix rejects configurations where a duplicating netem would share a tree with any other netem, preventing the pathological enqueue/dequeue loop. Exploitation requires local privileged network configuration (e.g., CAP_NET_ADMIN on the host or inside a netns), so the risk is bounded to DoS.

Remediation: