huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
CVE: CVE-2025-5477
Component: Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-06-11T17:40:51.489000+00:00

Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Sony XAV-AX8500 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability.

The specific flaw exists within the implementation of the Bluetooth L2CAP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the elysian-bt-service process. Was ZDI-CAN-26286.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
TOCTOU Vulnerability in NVIDIA Container Toolkit
CVE: CVE-2025-23359
Component: nvidia-container-toolkit
CWE: CWE-367
Severity: Important
CVSS v3: 8.3/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-02-12T00:52:43.646000+00:00

A flaw was found in the NVIDIA Container Toolkit for Linux. This vulnerability allows a crafted container image to gain access to the host file system via a Time-of-Check Time-of-Use (TOCTOU) flaw in the default configuration, potentially leading to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Statement: This vulnerability in the NVIDIA container toolkit does not affect Red Hat products.  Specially crafted container images are required for effective exploitation and none of the Red Hat signed containers are crafted in such a way as to allow exploitation.  Our containers which include the nvidia toolkit comply with our operating procedures by utilizing the Container Device Interface (CDI).  As noted in the Nvidia bulletin, the vulnerability does not impact use-cases where CDI is used.

We’ve rated this as important vs critical in the event that non-signed container images, crafted by an attacker, are permitted to be deployed in an environment.  This scenario is not typical.

Remediation:
soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
CVE: CVE-2025-38145
Component: kernel
Severity: None
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()

devm_kasprintf() returns NULL when memory allocation fails. Currently,
aspeed_lpc_enable_snoop() does not check for this case, which results in a
NULL pointer dereference.

Add NULL check after devm_kasprintf() to prevent this issue.

[arj: Fix Fixes: tag to use subject from 3772e5da4454]


Remediation:
misc: fastrpc: Fix copy buffer page size
CVE: CVE-2025-21734
Component: kernel
Severity: None
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix copy buffer page size

For non-registered buffer, fastrpc driver copies the buffer and
pass it to the remote subsystem. There is a problem with current
implementation of page size calculation which is not considering
the offset in the calculation. This might lead to passing of
improper and out-of-bounds page size which could result in
memory issue. Calculate page start and page end using the offset
adjusted address instead of absolute address.


Remediation:
mm/damon/sysfs: dealloc commit test ctx always
CVE: CVE-2025-40227
Component: kernel
Severity: None
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/sysfs: dealloc commit test ctx always

The damon_ctx for testing online DAMON parameters commit inputs is
deallocated only when the test fails.  This means memory is leaked for
every successful online DAMON parameters commit.  Fix the leak by always
deallocating it.


Remediation:
PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement
CVE: CVE-2025-14180
Component: php
CWE: CWE-476
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-27T19:21:20.768000+00:00

A flaw was found in PHP. When the PDO (PHP Data Objects) PostgreSQL driver is configured with `PDO::ATTR_EMULATE_PREPARES` enabled, a remote attacker can exploit a vulnerability by providing an invalid character sequence within a prepared statement parameter. This can cause a null pointer dereference, leading to a server crash. The primary impact is a Denial of Service (DoS), affecting the availability of the target server.

Statement: This vulnerability is rated Important for Red Hat because it can lead to a Denial of Service in PHP applications utilizing the PDO PostgreSQL driver. Exploitation requires the `PDO::ATTR_EMULATE_PREPARES` option to be explicitly enabled, allowing a remote attacker to crash the server by providing a specially crafted invalid character sequence in a prepared statement parameter.

Remediation:
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Stack-based Buffer Overflow in libwebsockets
CVE: CVE-2025-11678
Component: libwebsockets
CWE: CWE-121
Severity: Important
CVSS v3: 7.5/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-10-20T13:51:17.328000+00:00

A stack based buffer overflow flaw has been discovered in libwebsockets. The vulnerability allows an attacker that can inspect DNS requests made by the victim (e.g. being in the same wireless network) to forge a DNS response packet that overflows the stack and may lead to arbitrary code execution.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm/sched: Increment job count before swapping tail spsc queue
CVE: CVE-2025-38515
Component: kernel
Severity: None
Release date: 2025-08-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/sched: Increment job count before swapping tail spsc queue

A small race exists between spsc_queue_push and the run-job worker, in
which spsc_queue_push may return not-first while the run-job worker has
already idled due to the job count being zero. If this race occurs, job
scheduling stops, leading to hangs while waiting on the job’s DMA
fences.

Seal this race by incrementing the job count before appending to the
SPSC queue.

This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in
an SVM test case.


Remediation:
Event Stream Test Mode Exposes Sensitive Headers in AAP EDA
CVE: CVE-2025-9907
Component: event-driven-ansible
CWE: CWE-200
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-09-17T23:59:00+00:00

A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.

Statement: This issue is classified as Moderate because the exposure of sensitive headers, including client Authorization tokens and internal infrastructure values such as X-Trusted-Proxy, can lead to credential leakage and privilege escalation only after user forced mistake and with specific configuration. Exploitation does not require complex conditions—any user with read access to the event stream can retrieve the headers once a request has been posted in test mode. Exploitation depends on either a user mistakenly sending credentials to the event stream endpoint or internal headers being injected when the wrong path is used. The persistence of captured headers further increases risk, as sensitive values remain accessible until explicitly overwritten or deleted.

Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrading
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Moodle: Data exposure of user identifiers in URLs
CVE: CVE-2025-67857
Component: moodle
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2025-12-15T04:00:00+00:00

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Authlib : JWE zip=DEF decompression bomb enables DoS
CVE: CVE-2025-62706
Component: authlib
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-22T21:31:10.997000+00:00

A denial-of-service vulnerability exists in Authlib’s JWE (JSON Web Encryption) handling for zip=DEF compression. In versions prior to 1.6.5, the library performs unbounded DEFLATE decompression when processing JWE tokens with "zip": "DEF" in the header, without imposing a maximum size limit on the output. An attacker able to supply decryptable tokens could craft a compressed JWE ciphertext that expands to an arbitrarily large size, causing excessive memory and CPU consumption and potentially exhausting system resources.


Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
For Satellite MCP integration see the Red Hat Satellite documentation.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
code execution when processing a malicious X-CLIP model file
CVE: CVE-2025-14929
Component: transformers
CWE: CWE-502
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:04:15.474000+00:00

A flaw was found in the Hugging Face Transformers library. The parsing of checkpoints fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious X-CLIP model, resulting in arbitrary code execution in the context of the current process processing the file.

Statement: To exploit this issue, an attacker must convince a user to process a specially crafted X-CLIP model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
To mitigate this issue, users should avoid processing X-CLIP model files from untrusted or unverified sources. Ensure that all X-CLIP model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.
mm/smaps: fix race between smaps_hugetlb_range and migration
CVE: CVE-2025-39754
Component: kernel
CWE: CWE-820
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/smaps: fix race between smaps_hugetlb_range and migration

smaps_hugetlb_range() handles the pte without holdling ptl, and may be
concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). 
The race is as follows.

smaps_hugetlb_range              migrate_pages
  huge_ptep_get
                                   remove_migration_ptes
				   folio_unlock
  pfn_swap_entry_folio
    BUG_ON

To fix it, hold ptl lock in smaps_hugetlb_range().


Remediation:
libcoap denial of service
CVE: CVE-2025-65493
Component: libcoap
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-11-24T00:00:00+00:00

NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
CVE: CVE-2025-71080
Component: kernel
CWE: CWE-368
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel's IPv6 routing subsystem on PREEMPT_RT kernels. When rt6_get_pcpu_route() returns NULL and the task is preempted, another task can install a per-CPU route entry. When the original task resumes and attempts cmpxchg() in rt6_make_pcpu_route(), the operation fails because the pointer is no longer NULL, triggering a BUG_ON crash.

Statement: This vulnerability specifically affects PREEMPT_RT (real-time) kernel configurations during IPv6 routing operations. Standard kernel builds are not affected as the race window does not exist without RT preemption. The crash requires specific timing conditions and concurrent IPv6 route operations on the same CPU.

Remediation:
ice: validate queue quanta parameters to prevent OOB access
CVE: CVE-2025-22118
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: validate queue quanta parameters to prevent OOB access

Add queue wraparound prevention in quanta configuration.
Ensure end_qid does not overflow by validating start_qid and num_queues.


Remediation:
Nothings stb stack-based overflow
CVE: CVE-2025-3409
Component: stb
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-04-08T04:31:03.810000+00:00

A flaw was found in stb. This vulnerability allows remote attackers to cause a stack-based buffer overflow via manipulation of the path_to_includes argument.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Improper Input Validation in huggingface/transformers
CVE: CVE-2025-3777
Component: transformers
CWE: CWE-20
Severity: Low
CVSS v3: 3.7/CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2025-07-07T09:55:38.190000+00:00

An input validation flaw has been discovered in the Hugging Face Transformers library. Given an attacker can feed in a url, an application using the transformers library may present what appears to be a YouTube link, but actually routes to a malicious domain.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
usb: typec: ucsi: displayport: Fix deadlock
CVE: CVE-2025-37967
Component: kernel
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix deadlock

This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock
functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector
mutex is only locked if a connection is established and the partner pointer
is valid. This resolves a deadlock scenario where
ucsi_displayport_remove_partner holds con->mutex waiting for
dp_altmode_work to complete while dp_altmode_work attempts to acquire it.

Statement: Fixes a local deadlock in USB Type-C DisplayPort alt mode handling. The security impact is limited, because affects system stability during rapid device connect/disconnect cycles.

Remediation:
FFmpeg: Out-of-bounds NUL-byte write in MPEG-DASH manifest handling
CVE: CVE-2025-59728
Component: FFmpeg
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-06T08:08:27.410000+00:00

A flaw was found in FFmpeg. This vulnerability allows an out-of-bounds NUL-byte write one byte past the end of the buffer, leading to potential denial of service or arbitrary code execution, via the processing of a specially crafted MPEG-DASH (Dynamic Adaptive Streaming over HTTP) manifest.

Statement: The highest threat to Red Hat products is to system availability, as processing a specially crafted MPEG-DASH manifest can lead to a denial of service.

Remediation:
net/mlx5: fs, fix UAF in flow counter release
CVE: CVE-2025-39979
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 7.8/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-10-15T00:00:00+00:00

A use-after-free flaw was discovered in the Linux kernel’s mlx5 (Net/MLX5) subsystem: within the function mlx5_cmd_hws_delete_fte() the HWS action reference count and mutex for a local flow counter were not initialized, meaning the flow-counter structure could already be freed while deleting the rule. This may lead to memory corruption or kernel instability.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Potential partial directory-traversal via archive.extract()
CVE: CVE-2025-59682
Component: django
CWE: CWE-22
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-01T00:00:00+00:00

A flaw was found in Django. The django.utils.archive.extract() function, used by startapp --templateand startproject --template, allowed partial directory-traversal via an archive with file paths sharing a common prefix with the target directory.


Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrading
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.