huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
python: CPython DecodeError Handling Vulnerability
CVE: CVE-2025-4516
Component: cpython
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-15T13:29:20.126000+00:00

A vulnerability has been identified in CPython's bytes.decode() function when used with the "unicode_escape" encoding and the "ignore" or "replace" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches like data exfiltration, the resulting unexpected program behavior could introduce instability, logic errors, or unintended side effects within applications that rely on this specific decoding functionality.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Authorization Bypass in Next.js Middleware
CVE: CVE-2025-29927
Component: nextjs
CWE: CWE-285
Severity: Critical
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-03-21T14:34:49.570000+00:00

A flaw was found in Next.js package. This vulnerability allows bypassing authorization checks within a Next.js application if the authorization check occurs in middleware.

Statement: This vulnerability is rated as Critical impact, rather than Important, because it allows complete authorization bypass in affected Next.js versions. Attackers can circumvent middleware-based authentication and access protected routes simply by including a specific HTTP header (x-middleware-subrequest). This bypasses all security controls implemented in middleware, granting unauthorized access to sensitive application functionality, including admin panels and restricted resources.

Red Hat Enterprise Linux is not affected by this vulnerability as the authorization functionality of Next.js is not in use and the component is only used at build time.

Red Hat Enterprise Linux AI is not affected since the listed components Pathservice and UI are not provided to the customers.

Red Hat Trusted Artifact Signer and Streams for Apache Kafka 2 are not affected by this vulnerability as they do not use Next.js for any authorization functionality.

Remediation:
Directory traversal in salt project
CVE: CVE-2025-22238
Component: salt
CVSS v3: 4.7/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Release date: 2025-06-13T06:58:19.550000+00:00

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm/radeon: Remove calls to drm_put_dev()
CVE: CVE-2025-68181
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Remove calls to drm_put_dev()

Since the allocation of the drivers main structure was changed to
devm_drm_dev_alloc() drm_put_dev()'ing to trigger it to be free'd
should be done by devres.

However, drm_put_dev() is still in the probe error and device remove
paths. When the driver fails to probe warnings like the following are
shown because devres is trying to drm_put_dev() after the driver
already did it.

[    5.642230] radeon 0000:01:05.0: probe with driver radeon failed with error -22
[    5.649605] ------------[ cut here ]------------
[    5.649607] refcount_t: underflow; use-after-free.
[    5.649620] WARNING: CPU: 0 PID: 357 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110

(cherry picked from commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4)


Remediation:
CVE: CVE-2025-9324
Component: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-08-21T20:11:59.487000+00:00

Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26802.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
serial: jsm: fix NPE during jsm_uart_port_init
CVE: CVE-2025-38265
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

serial: jsm: fix NPE during jsm_uart_port_init

No device was set which caused serial_base_ctrl_add to crash.

 BUG: kernel NULL pointer dereference, address: 0000000000000050
 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 16 UID: 0 PID: 368 Comm: (udev-worker) Not tainted 6.12.25-amd64 #1  Debian 6.12.25-1
 RIP: 0010:serial_base_ctrl_add+0x96/0x120
 Call Trace:
  <TASK>
  serial_core_register_port+0x1a0/0x580
  ? __setup_irq+0x39c/0x660
  ? __kmalloc_cache_noprof+0x111/0x310
  jsm_uart_port_init+0xe8/0x180 [jsm]
  jsm_probe_one+0x1f4/0x410 [jsm]
  local_pci_probe+0x42/0x90
  pci_device_probe+0x22f/0x270
  really_probe+0xdb/0x340
  ? pm_runtime_barrier+0x54/0x90
  ? __pfx___driver_attach+0x10/0x10
  __driver_probe_device+0x78/0x110
  driver_probe_device+0x1f/0xa0
  __driver_attach+0xba/0x1c0
  bus_for_each_dev+0x8c/0xe0
  bus_add_driver+0x112/0x1f0
  driver_register+0x72/0xd0
  jsm_init_module+0x36/0xff0 [jsm]
  ? __pfx_jsm_init_module+0x10/0x10 [jsm]
  do_one_initcall+0x58/0x310
  do_init_module+0x60/0x230

Tested with Digi Neo PCIe 8 port card.

Statement: A null pointer dereference was discovered in the jsm_uart_port_init() function of the jsm serial driver due to a missing initialization of the uart_port.dev field. This issue triggers a kernel crash when the driver attempts to register the serial port via serial_base_ctrl_add(). Exploitation requires the ability to load and initialize a kernel module (e.g., via `modprobe` or `insmod`), which is restricted to privileged users. As such, only a local user with administrative rights (CAP_SYS_MODULE or equivalent) can trigger the vulnerable code path, justifying PR:H.

Remediation:
CVE: CVE-2025-7290
Component: IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:58:54.665000+00:00

IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26226.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
CVE: CVE-2025-66035
Component: angular
CWE: CWE-940
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2025-11-26T22:18:35.692000+00:00

A logic error exists in Angular’s built-in XSRF protection causes the framework to misclassify protocol-relative URLs (i.e. URLs starting with “//”) as same-origin. As a result, the client automatically appends and sends the XSRF token in an X-XSRF-TOKEN header to the remote domain — potentially attacker-controlled — enabling unauthorized disclosure of the token and bypass of CSRF protection.


Remediation:
By using  protocol-relative URLs (URLs starting with //) in HttpClient requests and/or Disabling XSRF token attachment for non-same-origin requests using custom Angular interceptors, this vulnerability can be mitigated.
can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled
CVE: CVE-2025-40107
Component: kernel
Severity: None
Release date: 2025-11-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

This issue is similar to the vulnerability in the `mcp251x` driver,
which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from
sleep before interface was brought up").

In the `hi311x` driver, when the device resumes from sleep, the driver
schedules `priv->restart_work`. However, if the network interface was
not previously enabled, the `priv->wq` (workqueue) is not allocated and
initialized, leading to a null pointer dereference.

To fix this, we move the allocation and initialization of the workqueue
from the `hi3110_open` function to the `hi3110_can_probe` function.
This ensures that the workqueue is properly initialized before it is
used during device resume. And added logic to destroy the workqueue
in the error handling paths of `hi3110_can_probe` and in the
`hi3110_can_remove` function to prevent resource leaks.


Remediation:
ceph: fix race condition validating r_parent before applying state
CVE: CVE-2025-39927
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix race condition validating r_parent before applying state

Add validation to ensure the cached parent directory inode matches the
directory info in MDS replies. This prevents client-side race conditions
where concurrent operations (e.g. rename) cause r_parent to become stale
between request initiation and reply processing, which could lead to
applying state changes to incorrect directory inodes.

[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to
  move CEPH_CAP_PIN reference when r_parent is updated:

  When the parent directory lock is not held, req->r_parent can become
  stale and is updated to point to the correct inode.  However, the
  associated CEPH_CAP_PIN reference was not being adjusted.  The
  CEPH_CAP_PIN is a reference on an inode that is tracked for
  accounting purposes.  Moving this pin is important to keep the
  accounting balanced. When the pin was not moved from the old parent
  to the new one, it created two problems: The reference on the old,
  stale parent was never released, causing a reference leak.
  A reference for the new parent was never acquired, creating the risk
  of a reference underflow later in ceph_mdsc_release_request().  This
  patch corrects the logic by releasing the pin from the old parent and
  acquiring it for the new parent when r_parent is switched.  This
  ensures reference accounting stays balanced. ]


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
clk: davinci: Add NULL check in davinci_lpsc_clk_register()
CVE: CVE-2025-38635
Component: kernel
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

clk: davinci: Add NULL check in davinci_lpsc_clk_register()

devm_kasprintf() returns NULL when memory allocation fails. Currently,
davinci_lpsc_clk_register() does not check for this case, which results
in a NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue and ensuring
no resources are left allocated.


Remediation:
Denial-of-service vulnerability in Django on Windows
CVE: CVE-2025-64458
Component: Django
CWE: CWE-407
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-05T15:07:17.031000+00:00

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django.shortcuts.redirect`  were subject to a potential  denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Tapjacking in Android Custom Tabs using transition animations
CVE: CVE-2025-1939
Component: firefox
CWE: CWE-1021
Severity: Important
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2025-03-04T13:31:22.881000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could be used to trick a user into granting sensitive permissions by hiding what the user is actually clicking.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

This CVE is specific to Firefox for Android.

Remediation:
Insufficient policy enforcement in Devtools
CVE: CVE-2025-12909
Component: chromium-browser
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-11-07T23:23:38.684000+00:00

Insufficient policy enforcement in Devtools in Google Chrome allowed a remote attacker to leak cross-origin data via Devtools.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVE: CVE-2025-10934
Component: gimp
CWE: CWE-122
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-10-29T19:58:55.670000+00:00

A heap-based buffer overflow in GIMP’s X Window Dump (XWD) file parser allows an attacker to craft a malicious XWD file (or a web page that triggers opening one) that can overflow a heap buffer during parsing and lead to remote code execution in the context of the GIMP process. The flaw is tracked as CVE-2025-10934 and was disclosed by Trend Micro’s Zero Day Initiative on 29 Oct 2025; GIMP has published a fix.

Statement: Heap-based buffer overflows that occur during image-file parsing are high-risk because image libraries and editors routinely parse attacker-controlled files from email, the web, or shared drives; a successful overflow can corrupt heap metadata or function pointers and result in arbitrary code execution with the privileges of the GIMP process. Unlike a local information leak or read-only bug, this vulnerability enables control-flow hijacking (overwrite of heap-managed data or code pointers) when a user opens or previews a crafted XWD file — so an attacker only needs to get the victim to open a file or visit a page that causes the file to be loaded. The exploitability is increased when parsers perform large allocations based on unchecked length fields (the advisory describes missing validation of user-supplied lengths prior to copying into a heap buffer), which is a classic recipe for exploitable heap corruption. Because GIMP runs with the user’s privileges and is commonly installed on desktops, this makes the bug Important rather than merely Moderate.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
MONGO dissector infinite loop
CVE: CVE-2025-11626
Component: wireshark
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-10-10T22:33:26.431000+00:00

A flaw was found in Wireshark’s MONGO dissector. When processing certain malformed MONGO packets, the dissector could enter an infinite loop, leading to unbounded CPU consumption. This issue allows an attacker to cause a denial of service by sending a specially crafted packet on the network or by convincing a user to open a malicious capture file.


Remediation:
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
GIMP: Remote Code Execution via XCF File Parsing Use-After-Free
CVE: CVE-2025-14424
Component: gimp
CWE: CWE-416
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:31:33.530000+00:00

A flaw was found in GIMP. This use-after-free vulnerability in the XCF file parsing component allows a remote attacker to execute arbitrary code. Successful exploitation requires user interaction, where a target must open a specially crafted malicious XCF file. This can lead to the execution of unauthorized code in the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it allows for remote code execution in GIMP. Exploitation requires user interaction, specifically opening a specially crafted malicious XCF file.

Remediation:
To mitigate this issue, users should avoid opening untrusted XCF files with GIMP. If GIMP is not required, consider removing the `gimp` package from the system. This can be done using the package manager specific to your Red Hat distribution. For example, on Red Hat Enterprise Linux, you can use `sudo yum remove gimp` or `sudo dnf remove gimp`.
Linux kernel: Information disclosure via uninitialized data in tcf_connmark_dump()
CVE: CVE-2025-40279
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-12-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: sched: act_connmark: initialize struct tc_ife to fix kernel leak

In tcf_connmark_dump(), the variable 'opt' was partially initialized using a
designatied initializer. While the padding bytes are reamined
uninitialized. nla_put() copies the entire structure into a
netlink message, these uninitialized bytes leaked to userspace.

Initialize the structure with memset before assigning its fields
to ensure all members and padding are cleared prior to beign copied.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Incorrect Authorization in SimGear
CVE: CVE-2025-0781
Component: simgear
CVSS v3: 8.5/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-01-28T16:34:21.881000+00:00

An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Vim path traversal
CVE: CVE-2025-53906
Component: vim
CWE: CWE-22
Severity: Moderate
CVSS v3: 4.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
Release date: 2025-07-15T20:52:40.137000+00:00

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
bpf: Fix exclusive map memory leak
CVE: CVE-2025-68355
Component: kernel
Severity: None
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix exclusive map memory leak

When excl_prog_hash is 0 and excl_prog_hash_size is non-zero, the map also
needs to be freed. Otherwise, the map memory will not be reclaimed, just
like the memory leak problem reported by syzbot [1].

syzbot reported:
BUG: memory leak
  backtrace (crc 7b9fb9b4):
    map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
    __sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131


Remediation:
Chrome Cookie Key Exposure
CVE: CVE-2025-34092
Component: chromium
Release date: 2025-07-02T19:25:35.752000+00:00

A cookie encryption bypass flaw was found in Google Chrome. When Chrome encrypts a cookie key, it records its executable path as validation metadata. Later, when decrypting, the elevation service compares the requesting process’s path to this stored path. However, due to path canonicalization inconsistencies, an attacker can impersonate Chrome and successfully retrieve the encrypted cookie key.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-6655
Component: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-06-25T21:35:31.380000+00:00

PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26730.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: