huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
aap-gateway: Read-only Personal Access Token (PAT) bypasses write restrictions
CVE: CVE-2025-14025
Component: ansible-automation-platform/aap-gateway
CWE: CWE-279
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-12-04T10:10:00+00:00

A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).

Statement: Red Hat rates the severity as Important and not Critical because an attacker already needs a valid token belonging to a user account. If the user has additional permissions beyond read-only access, an attacker can bypass the read-only limitation of the token. 

The potential impact of this vulnerability depends on an organization’s permission model. Organizations face the most significant risk if read-only tokens are granted to individual users, instead of dedicated service accounts with restricted permissions. In the higher risk situation, attackers could create or update execution environments, projects, or run job templates.

Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
Defense-in-depth practices such as using RBAC to enforce the principle of least privilege and careful token management are essential to reduce the scope of impact. See this KCS article for additional details and strategies. https://access.redhat.com/articles/7136004
Kubernetes secrets-store-sync-controller discloses service account tokens in logs
CVE: CVE-2025-7445
Component: sigs.k8s.io/secrets-store-sync-controller
CVSS v3: 6.3/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2025-09-05T02:31:35.360000+00:00

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-5478
Component: Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability
Release date: 2025-06-11T17:40:57.145000+00:00

Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-AX8500 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the Bluetooth SDP protocol. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26288.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Nothings stb Header Array out-of-bounds read
CVE: CVE-2025-3406
Component: stb
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2025-04-08T03:31:12.145000+00:00

A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the component Header Array Handler. The manipulation of the argument w leads to out-of-bounds read. It is possible to launch the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
SSH Agent servers: Denial of Service due to malformed messages
CVE: CVE-2025-47914
Component: golang.org/x/crypto/ssh/agent
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-19T20:33:43.126000+00:00

A flaw was found in the SSH Agent servers component (golang.org/x/crypto/ssh/agent). This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a specially crafted, malformed message during new identity requests. The server fails to validate the size of these messages, leading to an out-of-bounds read that can cause the program to panic and terminate.

Statement: This vulnerability is rated Moderate for Red Hat products. The golang.org/x/crypto/ssh/agent library, when used in SSH Agent servers, does not properly validate the size of messages during new identity requests. A specially crafted malformed message can lead to an out-of-bounds read, causing the program to panic and resulting in a denial of service.

Remediation:
rtc: amlogic-a4: fix double free caused by devm
CVE: CVE-2025-68754
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rtc: amlogic-a4: fix double free caused by devm

The clock obtained via devm_clk_get_enabled() is automatically managed
by devres and will be disabled and freed on driver detach. Manually
calling clk_disable_unprepare() in error path and remove function
causes double free.

Remove the redundant clk_disable_unprepare() calls from the probe
error path and aml_rtc_remove(), allowing the devm framework to
automatically manage the clock lifecycle.


Remediation:
ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
CVE: CVE-2025-22117
Component: kernel
CWE: CWE-20
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()

Fix using the untrusted value of proto->raw.pkt_len in function
ice_vc_fdir_parse_raw() by verifying if it does not exceed the
VIRTCHNL_MAX_SIZE_RAW_PACKET value.


Remediation:
tracing: Do not register unsupported perf events
CVE: CVE-2025-71125
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A kernel warning was found in the Linux kernel's tracing subsystem. Synthetic events do not implement perf event registration, but the code attempts to register them anyway with a NULL function pointer. This triggers a warning in tracepoint_add_func() when users try to use perf to record synthetic events (e.g., "perf record -e synthetic:futex_wait").

Statement: This issue occurs when attempting to use perf with synthetic tracepoints, which are not currently supported for perf recording. The warning is triggered by attempting an unsupported operation rather than a security vulnerability. The fix returns -ENODEV to properly indicate the operation is not supported, avoiding the warning.

Remediation:
code execution when converting a malicious SEW model checkpoint
CVE: CVE-2025-14926
Component: transformers
CWE: CWE-94
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:04:32.162000+00:00

A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW model checkpoint, causing arbitrary code execution in the context of the user converting the file.

Statement: To exploit this issue, an attacker must convince a user to process a specially crafted SEW model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
To mitigate this issue, users should avoid converting SEW model checkpoints from untrusted or unverified sources. Ensure that all SEW model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.
Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
CVE: CVE-2025-68304
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's Bluetooth subsystem. The hci_conn lookup on the RX path uses a lock/lookup/unlock/use pattern that doesn't prevent concurrent deletion of the hci_conn structure. When hci_abort_conn_sync() or similar functions delete the connection while RX processing is ongoing, a use-after-free occurs.

Statement: Exploitation requires Bluetooth connectivity and specific timing between connection teardown and packet reception. Physical proximity or a compromised paired device may be required.

Remediation:
CVE: CVE-2025-15321
Component: Tanium addressed an improper input validation vulnerability in Tanium Appliance.
Release date: 2025-08-19T00:00:00+00:00

Tanium addressed an improper input validation vulnerability in Tanium Appliance.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-43541
Component: webkitgtk
CWE: CWE-843
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-17T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause a type confusion issue due to improper state handling and result in an unexpected crash.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected crash but the possibility of remote code execution is not discarded.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
staging: gpib: Fix Oops after disconnect in ni_usb
CVE: CVE-2025-22052
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

staging: gpib: Fix Oops after disconnect in ni_usb

If the usb dongle is disconnected subsequent calls to the
driver cause a NULL dereference Oops as the bus_interface
is set to NULL on disconnect.

This problem was introduced by setting usb_dev from the bus_interface
for dev_xxx messages.

Previously bus_interface was checked for NULL only in the the functions
directly calling usb_fill_bulk_urb or usb_control_msg.

Check for valid bus_interface on all interface entry points
and return -ENODEV if it is NULL.


Remediation:
ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
CVE: CVE-2025-68241
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A race condition was found in the Linux kernel's IPv4 routing code. When fnhe_remove_oldest() selects an fnhe entry for deletion, a concurrent __mkroute_output() can fetch and bind the same entry via rt_bind_exception() before it is freed. This results in a dst reference leak that prevents network device unregistration, causing the "waiting for sitX to become free" warning.

Statement: Exploitation requires concurrent SIT tunnel traffic with specific routing cache pressure. The primary impact is resource leakage preventing device cleanup, not a direct security compromise.

Remediation:
Heap buffer overflow in sniff_unknown()
CVE: CVE-2025-32052
Component: libsoup
CWE: CWE-126
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2025-04-03T00:00:00+00:00

A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read.


Remediation:
No mitigation is currently available for this vulnerability.
jfs: fix uninitialized waitqueue in transaction manager
CVE: CVE-2025-68168
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: fix uninitialized waitqueue in transaction manager

The transaction manager initialization in txInit() was not properly
initializing TxBlock[0].waitor waitqueue, causing a crash when
txEnd(0) is called on read-only filesystems.

When a filesystem is mounted read-only, txBegin() returns tid=0 to
indicate no transaction. However, txEnd(0) still gets called and
tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
waitqueue was never initialized because the initialization loop
started at index 1 instead of 0.

This causes a 'non-static key' lockdep warning and system crash:
  INFO: trying to register non-static key in txEnd

Fix by ensuring all transaction blocks including TxBlock[0] have
their waitqueues properly initialized during txInit().


Remediation:
PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
CVE: CVE-2025-21804
Component: kernel
CWE: CWE-121
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()

The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region()
macro to request a needed resource. A string variable that lives on the
stack is then used to store a dynamically computed resource name, which
is then passed on as one of the macro arguments. This can lead to
undefined behavior.

Depending on the current contents of the memory, the manifestations of
errors may vary. One possible output may be as follows:

  $ cat /proc/iomem
  30000000-37ffffff :
  38000000-3fffffff :

Sometimes, garbage may appear after the colon.

In very rare cases, if no NULL-terminator is found in memory, the system
might crash because the string iterator will overrun which can lead to
access of unmapped memory above the stack.

Thus, fix this by replacing outbound_name with the name of the previously
requested resource. With the changes applied, the output will be as
follows:

  $ cat /proc/iomem
  30000000-37ffffff : memory2
  38000000-3fffffff : memory3

[kwilczynski: commit log]


Remediation:
A website may exfiltrate image data cross-origin
CVE: CVE-2025-43392
Component: webkitgtk
CWE: CWE-200
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-11-20T00:00:00+00:00

A flaw was found in WebKitGTK. A malicious website may exfiltrate image data cross-origin due to improper handling of caches.

Statement: To exploit this issue, an attacker needs to trick a user into visiting a malicious website, potentially exposing sensitive information. Due to this reason, this flaw has been rated with a moderate severity.

Remediation:
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi, and yelp.

This vulnerability can only be exploited when these packages are installed in the system and used via a graphical interface to process untrusted web content, via GNOME, for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Chromium use after free
CVE: CVE-2025-6192
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-18T18:16:36.481000+00:00

A use after free flaw has been discovered in Google Chrome. This flaw may allow an attacker to trigger heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
aoe: clean device rq_list in aoedev_downdev()
CVE: CVE-2025-38326
Component: kernel
Severity: None
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

aoe: clean device rq_list in aoedev_downdev()

An aoe device's rq_list contains accepted block requests that are
waiting to be transmitted to the aoe target. This queue was added as
part of the conversion to blk_mq. However, the queue was not cleaned out
when an aoe device is downed which caused blk_mq_freeze_queue() to sleep
indefinitely waiting for those requests to complete, causing a hang. This
fix cleans out the queue before calling blk_mq_freeze_queue().


Remediation:
Heap Buffer Overflow in HDF5 H5VM_memcpyvv Function
CVE: CVE-2025-44904
Component: hdf5
CWE: CWE-122
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-05-30T00:00:00+00:00

A flaw was found in the H5VM_memcpyvv function in the HDF5 library. This vulnerability can allow memory corruption and application crashes via reading from a specially crafted compact dataset, leading to a heap-based buffer overflow.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GNU Binutils ld elflink.c elf_gc_sweep memory corruption
CVE: CVE-2025-5244
Component: binutils
CWE: CWE-119
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-27T13:00:14.904000+00:00

A vulnerability was found in GNU Binutils 2.40 to version 2.44 and affects the elf_gc_sweep function of the bfd/elflink.c file of the component ld. The manipulation leads to memory corruption and a program crash. An attacker must have local access to exploit this vulnerability.

Statement: The vulnerability relies upon the linker's -w command line option, which disables warnings and forces the linker to continue working even though it knows that it cannot produce valid output.  With this option enabled a code path is exposed which leads to a dereferencing of a NULL pointer and the segmentation fault. The -w command line option was introduced with the 2.40 release.

Remediation:
CVE: CVE-2025-7279
Component: IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:58:26.689000+00:00

IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CGM files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26213.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
xmedcon DICOM File malloc integer underflow
CVE: CVE-2025-2581
Component: xmedcon
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-21T05:00:22.250000+00:00

A flaw was found in XMedCon. This vulnerability allows an attacker to trigger an integer underflow via manipulating the malloc function, potentially leading to memory corruption or denial of service. The attack can be launched remotely.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.