huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Exim: remote SQL injection
CVE: CVE-2025-26794
Component: exim
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-21T00:00:00+00:00

Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)

Statement: The following conditions have to be met for being vulnerable:

- Exim Version 4.98
- Build time option _USE_SQLITE_ is set (it enables the use of SQLite
  for the hints databases) -- check the output of `exim -bV`, whether it
  contains
  ```
  Hints DB:
    Using sqlite3
  ```
- Runtime config enables ETRN (`acl_smtp_etrn` returns _accept_
  (defaults to _deny_))
- Runtime config enforces ETRN serialization (`smtp_etrn_serialize` is
  set to _true_ (defaults to _true_))

Remediation:
Tornado Multipart Form-Data Denial of Service
CVE: CVE-2025-47287
Component: tornado
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-15T21:17:55.188000+00:00

A flaw was found in Tornado. This vulnerability can lead to a a denial of service by generating an extremely high volume of log entries.

Statement: This vulnerability marked as Important because it leverages the synchronous nature of the logging subsystem to induce a DoS condition. Specifically, malformed multipart/form-data payloads cause repeated, blocking log writes, which stall the event loop that underpins Tornado’s asynchronous architecture. Furthermore, because the vulnerable multipart parser is enabled by default, applications that are otherwise well-secured and do not even use file uploads can still be targeted unless they explicitly block these requests at a proxy.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
CVE: CVE-2025-32387
Component: helm.sh/helm/v3
CWE: CWE-776
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-04-09T22:28:33.476000+00:00

A flaw was found in Helm v3. In affected versions of Helm, a specially crafted JSON Schema within a chart can lead to a stack overflow. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow.


Remediation:
To mitigate this vulnerability, ensure that the JSON Schema within any charts loaded by Helm does not have a large number of nested references. These JSON Schema files are larger than 10 MiB.
ptp: Add a upper bound on max_vclocks
CVE: CVE-2025-40057
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ptp: Add a upper bound on max_vclocks

syzbot reported WARNING in max_vclocks_store.

This occurs when the argument max is too large for kcalloc to handle.

Extend the guard to guard against values that are too large for
kcalloc

Statement: This vulnerability requires local access and permissions to write to PTP sysfs attributes. The impact is limited to triggering a kernel warning and potential denial of service. Systems not using PTP virtual clocks are not affected.

Remediation:
Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow
CVE: CVE-2025-2592
Component: assimp
CWE: CWE-122
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-03-21T14:00:18.480000+00:00

A flaw was found in the Open Asset Import Library (assimp). In affected versions, a heap-based buffer overflow condition can be triggered when processing a malformed CSM file. This may lead to an application crash or other undefined behavior.

Statement: No Red Hat products ship affected versions of Open Asset Import Library.

Remediation:
mm/damon/sysfs: fix use-after-free in state_show()
CVE: CVE-2025-39877
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs: fix use-after-free in state_show()

state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. 
This allows a use-after-free race:

CPU 0                         CPU 1
-----                         -----
state_show()                  damon_sysfs_turn_damon_on()
ctx = kdamond->damon_ctx;     mutex_lock(&damon_sysfs_lock);
                              damon_destroy_ctx(kdamond->damon_ctx);
                              kdamond->damon_ctx = NULL;
                              mutex_unlock(&damon_sysfs_lock);
damon_is_running(ctx);        /* ctx is freed */
mutex_lock(&ctx->kdamond_lock); /* UAF */

(The race can also occur with damon_sysfs_kdamonds_rm_dirs() and
damon_sysfs_kdamond_release(), which free or replace the context under
damon_sysfs_lock.)

Fix by taking damon_sysfs_lock before dereferencing the context, mirroring
the locking used in pid_show().

The bug has existed since state_show() first accessed kdamond->damon_ctx.

Statement: A race in mm/damon/sysfs::state_show() allowed reading kdamond->damon_ctx without holding damon_sysfs_lock, leading to a use-after-free when the context was concurrently replaced or destroyed by DAMON control paths. The fix mirrors pid_show() by taking damon_sysfs_lock around the dereference and query. Impact is primarily a kernel crash (DoS) triggered locally while DAMON is being reconfigured.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Node.js Worker Thread Exposure via Diagnostics Channel
CVE: CVE-2025-23083
Component: nodejs
CWE: CWE-863
Severity: Important
CVSS v3: 7.7/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-01-22T01:11:30.802000+00:00

A flaw was found in the Node.js diagnostics_channel. This vulnerability allows an attacker to reinstate and misuse worker constructors, potentially bypassing the Permission Model via hooking into events when a worker thread is created.

Statement: This vulnerability is rated as an Important severity because the diagnostics_channel utility, allowing attackers to hook into events triggered when a worker thread is created. This not only exposes user-defined workers but also internal workers, enabling the attacker to retrieve instances and potentially capture and reinstate their constructors for malicious purposes.

Remediation:
Signed Integer Overflow in Timestamp Multiplication in iputils ping
CVE: CVE-2025-47268
Component: iputils
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-05-05T00:00:00+00:00

A flaw was found in iputils ping, where a signed integer overflow occurs in timestamp multiplication. This issue could lead to incorrect timestamp calculations or denial of service when processing crafted ICMP Echo Reply packets.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
CVE: CVE-2025-23129
Component: kernel
CWE: CWE-459
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path

If a shared IRQ is used by the driver due to platform limitation, then the
IRQ affinity hint is set right after the allocation of IRQ vectors in
ath11k_pci_alloc_msi(). This does no harm unless one of the functions
requesting the IRQ fails and attempt to free the IRQ. This results in the
below warning:

WARNING: CPU: 7 PID: 349 at kernel/irq/manage.c:1929 free_irq+0x278/0x29c
Call trace:
 free_irq+0x278/0x29c
 ath11k_pcic_free_irq+0x70/0x10c [ath11k]
 ath11k_pci_probe+0x800/0x820 [ath11k_pci]
 local_pci_probe+0x40/0xbc

The warning is due to not clearing the affinity hint before freeing the
IRQs.

So to fix this issue, clear the IRQ affinity hint before calling
ath11k_pcic_free_irq() in the error path. The affinity will be cleared once
again further down the error path due to code organization, but that does
no harm.

Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-05266-QCAHSTSWPLZ_V2_TO_X86-1


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
PS unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30705
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:31:08.118000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
xml2rfc has an arbitrary file read vulnerability
CVE: CVE-2025-11058
Component: xml2rfc
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-08-26T17:45:11+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
CVE: CVE-2025-38335
Component: kernel
CWE: CWE-662
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT

When enabling PREEMPT_RT, the gpio_keys_irq_timer() callback runs in
hard irq context, but the input_event() takes a spin_lock, which isn't
allowed there as it is converted to a rt_spin_lock().

[ 4054.289999] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
[ 4054.290028] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/0
...
[ 4054.290195]  __might_resched+0x13c/0x1f4
[ 4054.290209]  rt_spin_lock+0x54/0x11c
[ 4054.290219]  input_event+0x48/0x80
[ 4054.290230]  gpio_keys_irq_timer+0x4c/0x78
[ 4054.290243]  __hrtimer_run_queues+0x1a4/0x438
[ 4054.290257]  hrtimer_interrupt+0xe4/0x240
[ 4054.290269]  arch_timer_handler_phys+0x2c/0x44
[ 4054.290283]  handle_percpu_devid_irq+0x8c/0x14c
[ 4054.290297]  handle_irq_desc+0x40/0x58
[ 4054.290307]  generic_handle_domain_irq+0x1c/0x28
[ 4054.290316]  gic_handle_irq+0x44/0xcc

Considering the gpio_keys_irq_isr() can run in any context, e.g. it can
be threaded, it seems there's no point in requesting the timer isr to
run in hard irq context.

Relax the hrtimer not to use the hard context.

Statement: The gpio_keys_irq_timer() function in the Linux kernel's gpio-keys driver was calling input_event() from hard interrupt context when PREEMPT_RT is enabled. This results in a crash due to rt_spin_lock() being invoked in an atomic context, violating real-time locking constraints. The fix replaces HRTIMER_MODE_REL_HARD with HRTIMER_MODE_REL to avoid executing the timer callback in hard IRQ context. Exploiting this issue or even reaching the vulnerable path requires privileged access - typically root - to load or manipulate the GPIO input subsystem (e.g., by configuring key handlers, loading drivers, or triggering specific hardware timers). Therefore, the Privileges Required should be marked High for the CVSS.

Remediation:
thunderbird: Memory safety bugs
CVE: CVE-2025-8035
Component: firefox
CWE: CWE-119
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-07-22T20:49:28.660000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140, and Thunderbird 140. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
drm/xe: Use local fence in error path of xe_migrate_clear
CVE: CVE-2025-37869
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Use local fence in error path of xe_migrate_clear

The intent of the error path in xe_migrate_clear is to wait on locally
generated fence and then return. The code is waiting on m->fence which
could be the local fence but this is only stable under the job mutex
leading to a possible UAF. Fix code to wait on local fence.

(cherry picked from commit 762b7e95362170b3e13a8704f38d5e47eca4ba74)

Statement: The bug actual only for latest version of Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 (and only if driver for Intel Xe series GPUs being used). It could happen on error path that would complex to trigger. The attack complexity is high.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
To mitigate this issue, prevent module xe from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
CVE: CVE-2025-9274
Component: Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability
Release date: 2025-08-20T22:03:15.379000+00:00

Oxford Instruments Imaris Viewer IMS File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Oxford Instruments Imaris Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of IMS files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21657.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
block: mark GFP_NOIO around sysfs ->store()
CVE: CVE-2025-21817
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

block: mark GFP_NOIO around sysfs ->store()

sysfs ->store is called with queue freezed, meantime we have several
->store() callbacks(update_nr_requests, wbt, scheduler) to allocate
memory with GFP_KERNEL which may run into direct reclaim code path,
then potential deadlock can be caused.

Fix the issue by marking NOIO around sysfs ->store()


Remediation:
BinUtils: Denial of Service via crafted PE file
CVE: CVE-2025-66866
Component: binutils
CWE: CWE-125
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-12-29T00:00:00+00:00

A flaw was found in BinUtils. An attacker can exploit a vulnerability in the `d_abi_tags` function within the `cp-demangle.c` file by providing a specially crafted Portable Executable (PE) file. This can lead to a Denial of Service (DoS), making the affected application unavailable to legitimate users.

Statement: This vulnerability is rated Low for Red Hat products. The flaw in BinUtils allows for a denial of service when processing a specially crafted Portable Executable (PE) file. For a successful attack to take place the user needs to be tricked to process the maliciously crafted PE binary using the affected program. The consequences of a successful attack is also restricted to the single process instance reading the malicious file and does not have a system-wide effect, presenting a Low impact in the availability criteria.

Remediation:
To mitigate this issue, users should avoid processing untrusted Portable Executable (PE) files with applications linked against BinUtils. Restricting the source of PE files to trusted origins can reduce the attack surface.
team: replace team lock with rtnl lock
CVE: CVE-2025-39733
Component: kernel
Severity: None
Release date: 2025-09-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

team: replace team lock with rtnl lock

syszbot reports various ordering issues for lower instance locks and
team lock. Switch to using rtnl lock for protecting team device,
similar to bonding. Based on the patch by Tetsuo Handa.


Remediation:
Httparty: Server-Side Request Forgery (SSRF) allows information disclosure and unauthorized internal access.
CVE: CVE-2025-68696
Component: httparty
CVSS v3: 9.3/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Release date: 2025-12-23T22:59:04.201000+00:00

A flaw was found in httparty, an API tool. This Server-Side Request Forgery (SSRF) vulnerability allows an attacker to trick the server into making requests to internal resources or other external domains on their behalf. This can lead to the disclosure of sensitive information, such as API keys, and enable unauthorized access to internal servers.

Statement: This vulnerability is rated Important for Red Hat as it affects `rubygem-httparty` in Fedora. The Server-Side Request Forgery (SSRF) flaw in `httparty` versions 0.23.2 and prior could lead to the leakage of API keys and allow unauthorized requests to internal servers. This impacts applications utilizing `httparty` for API interactions within the Red Hat ecosystem.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
dnsmasq Config File network.c check_servers null pointer dereference
CVE: CVE-2025-12199
Component: dnsmasq
CWE: CWE-476
Severity: None
Release date: 2025-10-27T01:02:09.029000+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

To reduce the risk, ensure that only trusted and validated configuration files are used by dnsmasq, and restrict write or modification permissions on /etc/dnsmasq.conf and related directories to authorized users. Avoid loading dynamically generated or unverified configurations.
iommu/riscv: prevent NULL deref in iova_to_phys
CVE: CVE-2025-39699
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/riscv: prevent NULL deref in iova_to_phys

The riscv_iommu_pte_fetch() function returns either NULL for
unmapped/never-mapped iova, or a valid leaf pte pointer that
requires no further validation.

riscv_iommu_iova_to_phys() failed to handle NULL returns.
Prevent null pointer dereference in
riscv_iommu_iova_to_phys(), and remove the pte validation.


Remediation:
Out of bounds memory access in V8
CVE: CVE-2025-0612
Component: chromium-browser
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2025-01-22T19:22:37.153000+00:00

Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
CVE: CVE-2025-38122
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO

gve_alloc_pending_packet() can return NULL, but gve_tx_add_skb_dqo()
did not check for this case before dereferencing the returned pointer.

Add a missing NULL check to prevent a potential NULL pointer
dereference when allocation fails.

This improves robustness in low-memory scenarios.


Remediation:
MapServer SQL injection
CVE: CVE-2025-59431
Component: mapserver
CVSS v3: 8.6/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-09-19T19:29:13.163000+00:00

MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.