huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
xwayland: Use-after-free in SyncInitTrigger()
CVE: CVE-2025-26601
Component: xorg
CWE: CWE-416
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-25T00:00:00+00:00

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity and are not affected by this bug.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
CVE: CVE-2025-40087
Component: kernel
Severity: None
Release date: 2025-10-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Define a proc_layoutcommit for the FlexFiles layout type

Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT
operation on a FlexFiles layout.


Remediation:
OpenCV use after free
CVE: CVE-2025-53644
Component: opencv
CWE: CWE-457
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-07-17T17:58:26.493000+00:00

A heap buffer write flaw was found in OpenCV. This vulnerability could result in arbitrary memory overwrites and code execution within the context of a program using OpenCV.

Statement: No Red Hat products or offerings are affected by this vulnerability as the vulnerable code is not present in opencv-3.4 that is shipped with Red Hat Enterprise Linux.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ax25: properly unshare skbs in ax25_kiss_rcv()
CVE: CVE-2025-39848
Component: kernel
Severity: None
Release date: 2025-09-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ax25: properly unshare skbs in ax25_kiss_rcv()

Bernard Pidoux reported a regression apparently caused by commit
c353e8983e0d ("net: introduce per netns packet chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could happen
without a major crash.

But the root cause is that ax25_kiss_rcv() can queue/mangle input skb
without checking if this skb is shared or not.

Many thanks to Bernard Pidoux for his help, diagnosis and tests.

We had a similar issue years ago fixed with commit 7aaed57c5c28
("phonet: properly unshare skbs in phonet_rcv()").


Remediation:
fs: ntfs3: Fix integer overflow in run_unpack()
CVE: CVE-2025-40068
Component: kernel
Severity: None
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

fs: ntfs3: Fix integer overflow in run_unpack()

The MFT record relative to the file being opened contains its runlist,
an array containing information about the file's location on the physical
disk. Analysis of all Call Stack paths showed that the values of the
runlist array, from which LCNs are calculated, are not validated before
run_unpack function.

The run_unpack function decodes the compressed runlist data format
from MFT attributes (for example, $DATA), converting them into a runs_tree
structure, which describes the mapping of virtual clusters (VCN) to
logical clusters (LCN). The NTFS3 subsystem also has a shortcut for
deleting files from MFT records - in this case, the RUN_DEALLOCATE
command is sent to the run_unpack input, and the function logic
provides that all data transferred to the runlist about file or
directory is deleted without creating a runs_tree structure.

Substituting the runlist in the $DATA attribute of the MFT record for an
arbitrary file can lead either to access to arbitrary data on the disk
bypassing access checks to them (since the inode access check
occurs above) or to destruction of arbitrary data on the disk.

Add overflow check for addition operation.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Remediation:
thunderbird: Memory safety bugs
CVE: CVE-2025-5268
Component: firefox
CWE: CWE-119
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-05-27T12:29:26.941000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Some memory bugs show evidence of memory corruption, and we presume that with enough effort, some of these could be exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
CVE: CVE-2025-7255
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:56.595000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26118.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
General unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50068
Component: mysql
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-15T19:27:37.241000+00:00

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Cluster executes to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Remediation:
pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw
CVE: CVE-2025-21982
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw

devm_kasprintf() calls can return null pointers on failure.
But the return values were not checked in npcm8xx_gpio_fw().
Add NULL check in npcm8xx_gpio_fw(), to handle kernel NULL
pointer dereference error.


Remediation:
btrfs: harden block_group::bg_list against list_del() races
CVE: CVE-2025-37856
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: harden block_group::bg_list against list_del() races

As far as I can tell, these calls of list_del_init() on bg_list cannot
run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),
as they are in transaction error paths and situations where the block
group is readonly.

However, if there is any chance at all of racing with mark_bg_unused(),
or a different future user of bg_list, better to be safe than sorry.

Otherwise we risk the following interleaving (bg_list refcount in parens)

T1 (some random op)                       T2 (btrfs_mark_bg_unused)
                                        !list_empty(&bg->bg_list); (1)
list_del_init(&bg->bg_list); (1)
                                        list_move_tail (1)
btrfs_put_block_group (0)
                                        btrfs_delete_unused_bgs
                                             bg = list_first_entry
                                             list_del_init(&bg->bg_list);
                                             btrfs_put_block_group(bg); (-1)

Ultimately, this results in a broken ref count that hits zero one deref
early and the real final deref underflows the refcount, resulting in a WARNING.


Remediation:
CVE: CVE-2025-6444
Component: ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability
Release date: 2025-06-23T14:02:07.908000+00:00

ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the implementation of the GetErrorResponse method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to relay NTLM credentials in the context of the current user. Was ZDI-CAN-25834.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libpcap: Data corruption via out-of-bounds write on Windows
CVE: CVE-2025-11964
Component: libpcap
CWE: CWE-787
Severity: Low
CVSS v3: 2.3/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-12-31T00:58:19.026000+00:00

A flaw was found in libpcap on Windows. When libpcap converts a Windows error message containing 4-byte UTF-8 characters, the utf_16le_to_utf_8_truncated() function can write data beyond its allocated buffer. This out-of-bounds write can lead to data corruption, impacting the integrity of the system. Exploitation requires high privileges and local access, with high attack complexity.

Statement: This vulnerability is rated Low for Red Hat as the flaw in libpcap specifically affects Windows operating systems. Red Hat products, including Red Hat Enterprise Linux and OpenShift Container Platform, are not affected as the vulnerable code is not present in their respective libpcap packages.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-43214
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
wifi: mac80211: don't flush non-uploaded STAs
CVE: CVE-2025-21828
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-03-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't flush non-uploaded STAs

If STA state is pre-moved to AUTHORIZED (such as in IBSS
scenarios) and insertion fails, the station is freed.
In this case, the driver never knew about the station,
so trying to flush it is unexpected and may crash.

Check if the sta was uploaded to the driver before and
fix this.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Vault TOTP Secrets Engine Code Reuse
CVE: CVE-2025-6014
Component: github.com/hashicorp/vault
CWE: CWE-156
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-08-01T17:50:09.308000+00:00

A flaw was found in github.com/hashicorp/vault. The Time-based One-Time Password Secrets Engine's (TOTP) validation endpoint allows code reuse during its validity period, enabling a remote attacker to potentially leverage existing, valid TOTP secrets. This vulnerability allows an attacker to authenticate as a user without providing a valid TOTP code, resulting in unauthorized access to resources protected by the TOTP Secrets Engine.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
exec: fix the racy usage of fs_struct->in_exec
CVE: CVE-2025-22029
Component: kernel
CWE: CWE-362
Severity: None
Release date: 2025-04-16T00:00:00+00:00

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved:
exec: fix the racy usage of fs_struct->in_exec

Statement: This CVE has been rejected by the Linux kernel community. Refer to the announcement: https://lore.kernel.org/linux-cve-announce/2025050126-REJECTED-7655@gregkh/

Remediation:
Rsync: Out of bounds array access via negative index
CVE: CVE-2025-10158
Component: rsync
CWE: CWE-129
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-11-18T14:24:19.210000+00:00

An out of bounds read flaw has been discovered in rsync. A malicious client acting as the receiver of an rsync file transfer can trigger an OOB read via a negative array index. The rsync client requires at least read access to the remote rsync module to trigger the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Elasticsearch Allocation of Resources Without Limits or Throttling
CVE: CVE-2025-68390
Component: elasticsearch
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-18T22:17:41.672000+00:00

A flaw was found in Elasticsearch. An authenticated user, with snapshot restore privileges, can cause an excessive memory allocation via a crafted HTTP request, resulting in a denial of service.

Statement: This issue can only be exploited by an authenticated user with snapshot restore privileges, limiting the scope to legitimate users of Elasticsearch. Additionally, the only security impact of this flaw is a denial of service due to excessive memory allocation. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To mitigate this issue, make sure that only necessary and trusted users have authentication credentials to the Elasticsearch instance with snapshot restore privileges, limiting the ability of malicious users to potentially exploit this vulnerability.
CVE: CVE-2025-7982
Component: Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability
Release date: 2025-07-22T17:59:33.154000+00:00

Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25476.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NULL pointer dereference when creating RTP sink for AAC (ADTS) stream (SETUP)
CVE: CVE-2025-65408
Component: live555
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-12-01T00:00:00+00:00

A flaw was found in Live555. A NULL pointer dereference in ADTSAudioFileServerMediaSubsession::createNewRTPSink() allows attackers to cause a denial of service via a specially crafted ADTS file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/mediatek: Fix device use-after-free on unbind
CVE: CVE-2025-40316
Component: kernel
Severity: None
Release date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Fix device use-after-free on unbind

A recent change fixed device reference leaks when looking up drm
platform device driver data during bind() but failed to remove a partial
fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix
kobject put for component sub-drivers").

This results in a reference imbalance on component bind() failures and
on unbind() which could lead to a user-after-free.

Make sure to only drop the references after retrieving the driver data
by effectively reverting the previous partial fix.

Note that holding a reference to a device does not prevent its driver
data from going away so there is no point in keeping the reference.


Remediation:
Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client
CVE: CVE-2025-21605
Component: redis
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-23T15:38:11.042000+00:00

A flaw was found in the Redis server. This flaw allows an unauthenticated client to cause an unlimited growth of output buffers until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted, and the memory is unavailable.

When password authentication is enabled on the Redis server but no password is provided, the client can still cause the output buffer to grow from "NOAUTH" responses until the system runs out of memory.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
A workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in the following different ways:

- Using network access control tools like firewalls, iptables, security groups, etc.
- Enabling TLS and requiring users to authenticate using client side certificates.
Kernel: Denial of Service in perf due to user stack sampling during process exit
CVE: CVE-2025-38424
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix sample vs do_exit()

Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
synchronous external abort -- most likely due to trying to access
MMIO in bad ways.

The crash further shows perf trying to do a user stack sample while in
exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address
space it is trying to access.

It turns out that we stop perf after we tear down the userspace mm; a
receipie for disaster, since perf likes to access userspace for
various reasons.

Flip this order by moving up where we stop perf in do_exit().

Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER
to abort when the current task does not have an mm (exit_mm() makes
sure to set current->mm = NULL; before commencing with the actual
teardown). Such that CPU wide events don't trip on this same problem.


Remediation:
vhost-scsi: protect vq->log_used with vq->mutex
CVE: CVE-2025-38074
Component: kernel
Severity: None
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vhost-scsi: protect vq->log_used with vq->mutex

The vhost-scsi completion path may access vq->log_base when vq->log_used is
already set to false.

    vhost-thread                       QEMU-thread

vhost_scsi_complete_cmd_work()
-> vhost_add_used()
   -> vhost_add_used_n()
      if (unlikely(vq->log_used))
                                      QEMU disables vq->log_used
                                      via VHOST_SET_VRING_ADDR.
                                      mutex_lock(&vq->mutex);
                                      vq->log_used = false now!
                                      mutex_unlock(&vq->mutex);

				      QEMU gfree(vq->log_base)
        log_used()
        -> log_write(vq->log_base)

Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be
reclaimed via gfree(). As a result, this causes invalid memory writes to
QEMU userspace.

The control queue path has the same issue.


Remediation: