huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
net-tools Stack Buffer Overflow
CVE: CVE-2025-46836
Component: net-tools
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-05-14T22:59:19.997000+00:00

A flaw was found in net-tools. This vulnerability allows arbitrary code execution or a crash via improper handling of interface labels from `/proc/net/dev`.


Remediation:
To mitigate this vulnerability, disable unprivileged user-namespaces (sysctl kernel.unprivileged_userns_clone=0) to remove the easiest non-privileged trigger path.
KoaJS Koa HTTP Header response.js back redirect
CVE: CVE-2025-8129
Component: koa
CWE: CWE-601
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-07-25T04:02:05.418000+00:00

A flaw was found in Koa. An issue was discovered in the back redirect functionality, used for redirect operations. This issue allows an attacker to manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website due to an insecure implementation. This issue allows attackers to perform phishing, social engineering, or other redirect-based attacks on users of affected applications.

Statement: To exploit this flaw, an attacker needs to convince a user into visiting a malicious link, limiting the possibility of exploitation. However, this vulnerability still has a moderate severity due to the impact of redirect-based attacks.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
media: cxusb: no longer judge rbuf when the write fails
CVE: CVE-2025-38229
Component: kernel
CWE: CWE-909
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: cxusb: no longer judge rbuf when the write fails

syzbot reported a uninit-value in cxusb_i2c_xfer. [1]

Only when the write operation of usb_bulk_msg() in dvb_usb_generic_rw()
succeeds and rlen is greater than 0, the read operation of usb_bulk_msg()
will be executed to read rlen bytes of data from the dvb device into the
rbuf.

In this case, although rlen is 1, the write operation failed which resulted
in the dvb read operation not being executed, and ultimately variable i was
not initialized.

[1]
BUG: KMSAN: uninit-value in cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]
BUG: KMSAN: uninit-value in cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196
 cxusb_gpio_tuner drivers/media/usb/dvb-usb/cxusb.c:124 [inline]
 cxusb_i2c_xfer+0x153a/0x1a60 drivers/media/usb/dvb-usb/cxusb.c:196
 __i2c_transfer+0xe25/0x3150 drivers/i2c/i2c-core-base.c:-1
 i2c_transfer+0x317/0x4a0 drivers/i2c/i2c-core-base.c:2315
 i2c_transfer_buffer_flags+0x125/0x1e0 drivers/i2c/i2c-core-base.c:2343
 i2c_master_send include/linux/i2c.h:109 [inline]
 i2cdev_write+0x210/0x280 drivers/i2c/i2c-dev.c:183
 do_loop_readv_writev fs/read_write.c:848 [inline]
 vfs_writev+0x963/0x14e0 fs/read_write.c:1057
 do_writev+0x247/0x5c0 fs/read_write.c:1101
 __do_sys_writev fs/read_write.c:1169 [inline]
 __se_sys_writev fs/read_write.c:1166 [inline]
 __x64_sys_writev+0x98/0xe0 fs/read_write.c:1166
 x64_sys_call+0x2229/0x3c80 arch/x86/include/generated/asm/syscalls_64.h:21
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x1e0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f


Remediation:
exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in EDA
CVE: CVE-2025-2877
Component: event-driven-ansible
CWE: CWE-1295
Severity: Important
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-03-25T00:00:00+00:00

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.

Statement: This flaw is rated as Important since it may potentially expose cleartext passwords to the user who started the Activation and to any user who has been granted privileges to observe the Activation.

Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Path Traversal in Vite Dev Server Allows Access to Restricted Files
CVE: CVE-2025-46565
Component: vite
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-05-01T17:20:29.773000+00:00

A flaw was found in Vite. This vulnerability allows unauthorized access to denied files in the project root through crafted path traversal sequences when the server is explicitly exposed to the network. These specially crafted sequences could bypass intended access controls, allowing an attacker to read files that should otherwise be protected.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
riscv: module: Fix out-of-bounds relocation access
CVE: CVE-2025-37975
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

riscv: module: Fix out-of-bounds relocation access

The current code allows rel[j] to access one element past the end of the
relocation section. Simplify to num_relocations which is equivalent to
the existing size expression.


Remediation:
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2025-43458
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-04T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper state management.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
CVE: CVE-2025-6658
Component: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-06-25T21:36:12.367000+00:00

PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26733.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
llama_index: Denial of Service due to uncontrolled memory consumption in SimpleDirectoryReader
CVE: CVE-2025-6208
Component: llama_index
CWE: CWE-1050
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in llama_index. The `SimpleDirectoryReader` component loads all files from a specified directory into memory before applying a user-defined file limit. This resource management flaw allows an attacker to cause uncontrolled memory consumption. This can lead to memory exhaustion and degraded performance, resulting in a Denial of Service (DoS) for systems utilizing the affected component.

Statement: This MODERATE impact flaw in `llama_index` affects Red Hat Ansible Automation Platform and OpenShift Lightspeed. The `SimpleDirectoryReader` component loads all files from a specified directory into memory before applying any user-defined file limits. This can lead to uncontrolled memory consumption, potentially causing a Denial of Service due to memory exhaustion and degraded performance in resource-constrained environments.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities
CVE: CVE-2025-39707
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities

HUBBUB structure is not initialized on DCE hardware, so check if it is NULL
to avoid null dereference while accessing amdgpu_dm_capabilities file in
debugfs.


Remediation:
Buffer Overflow vulnerability in libarchive
CVE: CVE-2025-25724
Component: libarchive
CWE: CWE-252
Severity: Moderate
CVSS v3: 4.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-03-02T00:00:00+00:00

A flaw was found in the libarchive package. Affected versions of libarchive do not check a strftime return value, which can lead to a denial of service or unspecified other impacts via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Statement: Red Hat employs static and dynamic security testing and numerous program hardening technologies as part of our Secure Development Lifecycle. These tests and means of hardening our software prevent or reduce the impact of flaws and increase the complexity of attacks.

Return values from critical operations are consistently evaluated through enforced development standards and automated static analysis, reducing the likelihood of logic flaws or silent failures reaching production. Error-handling routines are integrated into application behavior to ensure that failures are properly logged, traced, and contained, maintaining system stability under fault conditions. Additionally, the platform is designed to respond to errors predictably, preventing uncontrolled behavior and ensuring that processes fail in a known, recoverable state.

Remediation:
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
CVE: CVE-2025-21767
Component: kernel
CWE: CWE-662
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

A vulnerability was found in the Linux kernel's clocksource subsystem, specifically affecting systems running with the PREEMPT_RT (Real-Time) patch. In real-time kernels, certain locks used within the random number generation functions, are implemented as sleeping locks. Calling these functions in an atomic context—where sleeping is not allowed—can lead to kernel warnings or crashes. The issue occurs when the get_random_u32() function is called within an atomic context, which is not permissible in real-time kernels due to the use of sleeping locks in the random number generation code.


Remediation:
Unable to restrict access to the admin console
CVE: CVE-2025-10939
Component: org.keycloak/keycloak-quarkus-server
CWE: CWE-427
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-10-27T00:00:00+00:00

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to /realms which is expected to be exposed.


Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Memory leak in ATM clip module can lead to denial of service
CVE: CVE-2025-38546
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

atm: clip: Fix memory leak of struct clip_vcc.

ioctl(ATMARP_MKIP) allocates struct clip_vcc and set it to
vcc->user_back.

The code assumes that vcc_destroy_socket() passes NULL skb
to vcc->push() when the socket is close()d, and then clip_push()
frees clip_vcc.

However, ioctl(ATMARPD_CTRL) sets NULL to vcc->push() in
atm_init_atmarp(), resulting in memory leak.

Let's serialise two ioctl() by lock_sock() and check vcc->push()
in atm_init_atmarp() to prevent memleak.


Remediation:
CVE: CVE-2025-8646
Component: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Release date: 2025-08-06T01:13:57.006000+00:00

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26269.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
JavaScript Execution via Spoofed PDF Attachment and file:/// Link
CVE: CVE-2025-3909
Component: thunderbird
CWE: CWE-290
Severity: Important
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-05-14T16:56:43.630000+00:00

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Unexpected GC during RegExp bailout processing
CVE: CVE-2025-1934
Component: firefox
CWE: CWE-460
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-03-04T13:31:24.734000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
wifi: ath12k: fix uaf in ath12k_core_init()
CVE: CVE-2025-38116
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix uaf in ath12k_core_init()

When the execution of ath12k_core_hw_group_assign() or
ath12k_core_hw_group_create() fails, the registered notifier chain is not
unregistered properly. Its memory is freed after rmmod, which may trigger
to a use-after-free (UAF) issue if there is a subsequent access to this
notifier chain.

Fixes the issue by calling ath12k_core_panic_notifier_unregister() in
failure cases.

Call trace:
 notifier_chain_register+0x4c/0x1f0 (P)
 atomic_notifier_chain_register+0x38/0x68
 ath12k_core_init+0x50/0x4e8 [ath12k]
 ath12k_pci_probe+0x5f8/0xc28 [ath12k]
 pci_device_probe+0xbc/0x1a8
 really_probe+0xc8/0x3a0
 __driver_probe_device+0x84/0x1b0
 driver_probe_device+0x44/0x130
 __driver_attach+0xcc/0x208
 bus_for_each_dev+0x84/0x100
 driver_attach+0x2c/0x40
 bus_add_driver+0x130/0x260
 driver_register+0x70/0x138
 __pci_register_driver+0x68/0x80
 ath12k_pci_init+0x30/0x68 [ath12k]
 ath12k_init+0x28/0x78 [ath12k]

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3

Statement: The vulnerability is classified as a use-after-free in the ath12k_core_init() function. It occurs when the notifier chain is not properly unregistered upon initialization failure, potentially leading to kernel crashes upon later access. For the CVSS the Privileges Required (PR) metric is set to High, as exploitation requires the ability to load and unload kernel modules (e.g., insmod/rmmod), which is restricted to privileged users with CAP_SYS_MODULE or root access. The bug is relevant only for the latest version of Red Hat Enterprise Linux 9 (and newer), because in earlier versions the Linux kernel config option CONFIG_ATH12K was disabled.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module ath12k from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Kernel: Privilege escalation via uninitialized data in vmci transport packet
CVE: CVE-2025-38403
Component: kernel
CWE: CWE-909
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel's vsock/vmci component. A local attacker with low privileges could exploit a vulnerability where the vmci_transport_packet structure is not properly cleared during initialization. This can lead to the use of uninitialized data, potentially allowing for information disclosure, privilege escalation, or a denial of service (DoS).


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
sctp: Prevent TOCTOU out-of-bounds write
CVE: CVE-2025-40331
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sctp: Prevent TOCTOU out-of-bounds write

For the following path not holding the sock lock,

  sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()

make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).


Remediation:
idpf: fix null-ptr-deref in idpf_features_check
CVE: CVE-2025-38053
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-06-18T00:00:00+00:00

A flaw was found in the idpf module in the Linux kernel. A null pointer dereference can be triggered when the driver attempts to use a resource that has already been released, resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.10 and 9.4 via RHSA-2025:9580 [1] and RHSA-2024:2394 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2025:9580

[2]. https://access.redhat.com/errata/RHSA-2024:2394

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases
CVE: CVE-2025-21788
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases

If the XDP program doesn't result in XDP_PASS then we leak the
memory allocated by am65_cpsw_build_skb().

It is pointless to allocate SKB memory before running the XDP
program as we would be wasting CPU cycles for cases other than XDP_PASS.
Move the SKB allocation after evaluating the XDP program result.

This fixes the memleak. A performance boost is seen for XDP_DROP test.

XDP_DROP test:
Before: 460256 rx/s                  0 err/s
After:  784130 rx/s                  0 err/s


Remediation: