huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting
CVE: CVE-2025-38235
Component: kernel
Severity: None
Release date: 2025-07-06T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: appletb-kbd: fix "appletb_backlight" backlight device reference counting

During appletb_kbd_probe, probe attempts to get the backlight device
by name. When this happens backlight_device_get_by_name looks for a
device in the backlight class which has name "appletb_backlight" and
upon finding a match it increments the reference count for the device
and returns it to the caller. However this reference is never released
leading to a reference leak.

Fix this by decrementing the backlight device reference count on removal
via put_device and on probe failure.


Remediation:
Processing maliciously crafted web content may lead to an unexpected Safari crash
CVE: CVE-2025-24216
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-04-07T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

A system reboot might be required for this errata to take effect.
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
spi: ch341: fix out-of-bounds memory access in ch341_transfer_one
CVE: CVE-2025-68352
Component: kernel
Severity: None
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spi: ch341: fix out-of-bounds memory access in ch341_transfer_one

Discovered by Atuin - Automated Vulnerability Discovery Engine.

The 'len' variable is calculated as 'min(32, trans->len + 1)',
which includes the 1-byte command header.

When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len'
as the length is incorrect because:

1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size
   'trans->len', i.e., 'len - 1' in this context).
2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is
   CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1
   overflows the buffer.

Fix this by copying 'len - 1' bytes.


Remediation:
Wasmtime has host panic
CVE: CVE-2025-53901
Component: wasmtime
CVSS v3: 3.7/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-07-18T17:10:11.815000+00:00

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The specific bug is triggered by calling `path_open` after calling `fd_renumber` with either two equal argument values or a second argument being equal to a previously-closed file descriptor number value. The corrupt state introduced in `fd_renumber` will lead to the subsequent opening of a file descriptor to panic. This panic cannot introduce memory unsafety or allow WebAssembly to break outside of its sandbox, however. There is no possible heap corruption or memory unsafety from this panic. This bug is in the implementation of Wasmtime's `wasmtime-wasi` crate which provides an implementation of WASIp1. The bug requires a specially crafted call to `fd_renumber` in addition to the ability to open a subsequent file descriptor. Opening a second file descriptor is only possible when a preopened directory was provided to the guest, and this is common amongst embeddings. A panic in the host is considered a denial-of-service vector for WebAssembly embedders and is thus a security issue in Wasmtime. This bug does not affect WASIp2 and embedders using components. In accordance with Wasmtime's release process, patch releases are available as 24.0.4, 33.0.2, and 34.0.2. Users of other release of Wasmtime are recommended to move to a supported release of Wasmtime. Embedders who are using components or are not providing guest access to create more file descriptors (e.g. via a preopened filesystem directory) are not affected by this issue. Otherwise, there is no workaround at this time, and affected embeddings are recommended to update to a patched version which will not cause a panic in the host.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-6652
Component: PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-06-25T21:34:49.638000+00:00

PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26724.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NVIDIA Display Driver Null pointer dereference
CVE: CVE-2025-23300
Component: nvidia-display-driver
CWE: CWE-476
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-23T18:24:21.817000+00:00

NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocating a specific memory resource. A successful exploit of this vulnerability might lead to denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GIMP: Remote Code Execution via stack-based buffer overflow in LBM file parsing
CVE: CVE-2025-14423
Component: gimp
CWE: CWE-121
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:31:23.374000+00:00

A flaw was found in GIMP. This stack-based buffer overflow vulnerability occurs during the parsing of LBM files due to insufficient validation of user-supplied data length. A remote attacker can exploit this by tricking a user into opening a specially crafted malicious LBM file. Successful exploitation could lead to arbitrary code execution in the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it allows for remote code execution in GIMP. Exploitation requires user interaction, specifically tricking a user into opening a specially crafted malicious LBM file.

Remediation:
To mitigate this vulnerability, users should avoid opening untrusted LBM files with GIMP. If GIMP is not essential for system operation, consider removing the `gimp` package to eliminate the attack surface. This can be done using the system's package manager. For example, on Red Hat Enterprise Linux, use `sudo yum remove gimp` or `sudo dnf remove gimp`.
Exposure of VCenter Credentials via ClusterProvision in Hive / MCE / ACM
CVE: CVE-2025-2241
Component: hive
CWE: CWE-922
Severity: Important
CVSS v3: 8.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Release date: 2025-03-17T15:52:50.098000+00:00

A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to ClusterProvision objects can extract sensitive credentials even if they do not have direct access to Kubernetes Secrets. This issue can lead to unauthorized VCenter access, cluster management, and privilege escalation.

Statement: Hive is an operator which runs as a service for provisioning and perform initial configuration of OpenShift clusters. During this process users are creating instances of hive CRDs and other k8s objects, including a Secret containing credentials where Hive take these inputs and invokes openshift-install to create the spoke cluster. During this process it generations additional objects. One of these objects is an instance of a hive CRD called ClusterProvision. The ClusterProvision object contains unintentionally sensitive information, which may be accessed by unauthorized actors.

Remediation:
A few mechanisms are available to reduce the risks and mitigate this vulnerability:

1. Restrict Access to ClusterProvision Objects

Ensure that only trusted users with valid VCenter credentials have read access to ClusterProvision objects.
This can be verified using the following commands:

oc adm policy who-can get clusterprovision
oc adm policy who-can read clusterprovision

2. Rotate VCenter Credentials

Immediately rotate VCenter credentials to revoke access for any users who may have already accessed the exposed credentials.

3. Audit VCenter Users and Roles

Conduct a security audit of VCenter accounts and roles to detect any unauthorized access or configuration changes.

If any suspicious activity is found, revoke access by rotating credentials again (step 2) and taking necessary remediation actions.
io_uring: fix regbuf vector size truncation
CVE: CVE-2025-40291
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Release date: 2025-12-08T00:00:00+00:00

An integer truncation vulnerability was found in the io_uring subsystem of the Linux kernel. The io_estimate_bvec_size() function can calculate a segment count that overflows when stored in an int, leading to undersized buffer allocations and subsequent memory corruption.

Statement: io_uring is a high-performance async I/O interface that local users can access. Exploitation requires crafting specific buffer registrations that trigger the overflow, which could lead to heap corruption.

Remediation:
btrfs: avoid NULL pointer dereference if no valid csum tree
CVE: CVE-2025-38059
Component: kernel
CWE: CWE-476
Severity: None
Release date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: avoid NULL pointer dereference if no valid csum tree

[BUG]
When trying read-only scrub on a btrfs with rescue=idatacsums mount
option, it will crash with the following call trace:

  BUG: kernel NULL pointer dereference, address: 0000000000000208
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G           O        6.15.0-rc3-custom+ #236 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022
  RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs]
  Call Trace:
   <TASK>
   scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs]
   scrub_simple_mirror+0x175/0x290 [btrfs]
   scrub_stripe+0x5f7/0x6f0 [btrfs]
   scrub_chunk+0x9a/0x150 [btrfs]
   scrub_enumerate_chunks+0x333/0x660 [btrfs]
   btrfs_scrub_dev+0x23e/0x600 [btrfs]
   btrfs_ioctl+0x1dcf/0x2f80 [btrfs]
   __x64_sys_ioctl+0x97/0xc0
   do_syscall_64+0x4f/0x120
   entry_SYSCALL_64_after_hwframe+0x76/0x7e

[CAUSE]
Mount option "rescue=idatacsums" will completely skip loading the csum
tree, so that any data read will not find any data csum thus we will
ignore data checksum verification.

Normally call sites utilizing csum tree will check the fs state flag
NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all.

This results in scrub to call btrfs_search_slot() on a NULL pointer
and triggered above crash.

[FIX]
Check both extent and csum tree root before doing any tree search.


Remediation:
orangefs: fix a oob in orangefs_debug_write
CVE: CVE-2025-21782
Component: kernel
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

orangefs: fix a oob in orangefs_debug_write

I got a syzbot report: slab-out-of-bounds Read in
orangefs_debug_write... several people suggested fixes,
I tested Al Viro's suggestion and made this patch.


Remediation:
Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow
CVE: CVE-2025-2754
Component: assimp
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-03-25T08:31:07.954000+00:00

A flaw was found in the Open Asset Import Library Assimp. The Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component is affected. This attack can be launched remotely, and manipulation of the argument can lead to a heap-based buffer overflow.


Remediation:
Denial of service via crafted TCP exchange
CVE: CVE-2025-30193
Component: dnsdist
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T11:17:17.378000+00:00

In some circumstances, when DNSdist is configured to allow an unlimited number of queries on a single, incoming TCP connection from a client, an attacker can cause a denial of service by crafting a TCP exchange that triggers an exhaustion of the stack and a crash of DNSdist, causing a denial of service.

The remedy is: upgrade to the patched 1.9.10 version.

A workaround is to restrict the maximum number of queries on incoming TCP connections to a safe value, like 50, via the setMaxTCPQueriesPerConnection setting.

We would like to thank Renaud Allard for bringing this issue to our attention.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ONNX path traversal
CVE: CVE-2025-51480
Component: onnx
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-07-22T00:00:00+00:00

A path traversal flaw was found in the ONNX machine learning library. This flaw allows an attacker to overwrite arbitrary files in the scope of the affected program using the library.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm/msm: Fix another leak in the submit error path
CVE: CVE-2025-38409
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix another leak in the submit error path

put_unused_fd() doesn't free the installed file, if we've already done
fd_install().  So we need to also free the sync_file.

Patchwork: https://patchwork.freedesktop.org/patch/653583/


Remediation:
SQL Injection in langchain-ai/langchain
CVE: CVE-2025-8709
Component: langchain
CWE: CWE-89
Severity: Important
CVSS v3: 7.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Release date: 2025-10-26T05:38:55.335000+00:00

A SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path is directly concatenated into SQL statements without sanitization or parameterization. This allows an attacker who can control filter keys to inject arbitrary SQL expressions, bypass access controls, and retrieve sensitive data such as passwords or API keys from the database.

Statement: Red Hat Product Security team has reviewed this issue and determined that it does not impact any of our products. The vulnerable component, LangGraph SQLite Checkpoint (langgraph-checkpoint-sqlite), is not shipped or included in any Red Hat product or offering. Since this package is not part of our supported codebase or dependencies, no Red Hat products are affected by this vulnerability.

This vulnerability is classified as Important severity rather than Critical because, while it enables full data exposure and access-control bypass within the SQLite store, it does not lead to direct remote code execution or full system compromise. Exploitation requires the attacker to have access to the LangGraph API or a component that processes user-supplied filters, meaning it is not automatically exploitable over the network without prior access. Technically, the flaw results in SQL query manipulation confined to the application’s data layer, impacting confidentiality and integrity but not the execution flow or host environment.

Technically, the bug is in _get_filter_condition() where filter expressions are assembled by concatenating the JSON path key into a SQL fragment like json_extract(value, '$.<key>') = '<value>'; only the value is escaped (value.replace("'", "''")) while the key is inserted verbatim. Because the JSON path is embedded inside the SQL string, a crafted key containing quote characters and SQL payload (for example: access') = 'public' OR '1'='1' --) can close the path/string literal and append arbitrary SQL, turning a single-column equality check into a logical expression that matches all rows or extracts other fields via json_extract(...). Safe remediation requires eliminating runtime string concatenation of keys — either bind the entire JSON path as a parameter (e.g., json_extract(value, ?) with a bound f'$.{key}'), or map incoming filter keys to a server-side whitelist of trusted JSON paths; additionally validate keys with a strict pattern (e.g., ^[A-Za-z0-9_.-]+$) and add unit/fuzz tests that assert malicious keys/values cannot alter generated SQL.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
ImageMagick BlobStream Forward-Seek Under-Allocation
CVE: CVE-2025-57807
Component: imagemagick
CWE: CWE-787
Severity: Moderate
CVSS v3: 4.2/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-09-05T21:16:02.742000+00:00

A heap based out of bounds write flaw has been discovered in ImageMagick. For memory-backed blobs SeekBlob() permits advancing the stream offset beyond the current end without increasing capacity. The subsequent WriteBlob() then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Qt6 denial of service
CVE: CVE-2025-5992
Component: qt6
CWE: CWE-20
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-07-11T06:45:15.082000+00:00

A denial of service flaw has been discovered in the Qt library. A call to `QColorTransferGenericFunction` may cause a crash if passed a maliciously crafted ICC profile.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to memory corruption
CVE: CVE-2025-31278
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-08-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
GNU Binutils ld libbfd.c bfd_putl64 memory corruption
CVE: CVE-2025-1178
Component: binutils
CWE: CWE-119
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-02-11T06:31:12.580000+00:00

A flaw was found in GNU Binutils. This vulnerability allows memory corruption via manipulation of the bfd_putl64 function.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.