huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
cpython: Arbitrary writes via tarfile realpath overflow
CVE: CVE-2025-4517
Component: python
CWE: CWE-22
Severity: Important
CVSS v3: 7.7/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-06-03T12:58:50.352000+00:00

A flaw was found in the CPython tarfile module. This vulnerability allows arbitrary filesystem writes outside the extraction directory via extracting untrusted tar archives using the TarFile.extractall() or TarFile.extract() methods with the extraction filter parameter set to "data" or "tar".

Statement: The severity of this vulnerability was lowered due to the fact that successful exploitation requires the attacker to convince a privileged user or process to extract a malicious tar file. Since tar file extraction typically occurs in trusted contexts or with elevated privileges, the impact is reduced by the requirement of such access.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Remediation:
The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).

Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

The steps to apply the upgraded images are different depending on the installation plan approval policy you used
when installing the cert-manager Operator for Red Hat OpenShift.

- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a
new version of the Operator. No further action is required to upgrade. This is the default setting.

- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.

See https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional
information.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-9325
Component: Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-08-21T20:11:55.222000+00:00

Foxit PDF Reader PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26785.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
fontTools: Arbitrary file write leading to remote code execution via malicious .designspace file
CVE: CVE-2025-66034
Component: fonttools
CWE: CWE-91
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L
Release date: 2025-11-29T01:07:12.193000+00:00

This vulnerability in fontTools varLib allows a crafted .designspace file to trigger arbitrary file writes and XML-based content injection during variable-font generation. Because filenames are not sanitized, an attacker can use path traversal to overwrite files anywhere on the filesystem, and malicious payloads embedded in XML labelname elements can be injected directly into the generated output. When these overwritten files reside in executable or web-served locations, this can enable local remote-code execution or corruption of application or configuration files. The issue affects the varLib CLI and any code that invokes fontTools.varLib.main().

Statement: This issue is rated Moderate rather than Important because the exploitability hinges on several limiting technical factors despite the high integrity impact. The arbitrary file-write and XML-injection pathways are only reachable when a user or automated workflow locally processes a malicious .designspace file, giving the flaw a local attack vector (AV:L) and requiring explicit user interaction (UI:R)—meaning an attacker cannot trigger it remotely over the network. The attack also involves high complexity (AC:H), as it depends on crafted designspace structures, controlled font sources, and specific invocation of fonttools varLib or code that directly calls varLib.main(). Additionally, the vulnerability does not expose confidentiality, and availability effects are limited to potential file corruption. These constraints significantly narrow real-world exposure, keeping the risk profile in the Moderate range despite the possibility of high local integrity impact when exploited.

Remediation:
For Red Hat OpenShift AI 2.25.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 2.25.2 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
To mitigate this issue, avoid processing untrusted .designspace files with the fontTools varLib script or any application that invokes fontTools.varLib.main(). Restrict the execution environment of processes handling .designspace files to minimize potential impact from arbitrary file writes. If the fonttools package is not required, consider removing it.
CVE: CVE-2025-7291
Component: IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:58:57.072000+00:00

IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26227.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nvme-tcp: sanitize request list handling
CVE: CVE-2025-38264
Component: kernel
CWE: CWE-672
Severity: Important
CVSS v3: 7.2/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: sanitize request list handling

Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
any list, otherwise a malicious R2T PDU might inject a loop in request
list processing.

Statement: The vulnerability lies in the lack of validation for list membership in nvme_tcp_handle_r2t(), potentially allowing malicious R2T PDUs to introduce list corruption or loops. This could lead to denial of service or memory corruption.
The Privileges for the CVSS is Low as the attacker only needs access to an NVMe TCP queue, which may be exposed via user-level networking or containerized environments. This bug can be triggered remotely if a Linux system connects to a malicious or compromised NVMe-over-TCP target. The attacker, by crafting a malformed R2T PDU, could cause list corruption in the initiator’s kernel, potentially leading to memory corruption or denial of service. The issue is not locally triggerable by userspace but can be remotely exploited by an attacker controlling the target. The config option CONFIG_NVME_COMMON disabled in all versions of Red Hat Enterprise Linux, so as result all versions are not affected.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Check if Kernel config option CONFIG_NVME_COMMON disabled or could be disabled. If disabled, then not vulnerable.
GNU libmicrohttpd null pointer dereference
CVE: CVE-2025-59777
Component: libmicrohttpd
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-10T04:10:44.836000+00:00

NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. The vulnerability was fixed in commit ff13abc on the master branch of the libmicrohttpd Git repository, after the v1.0.2 tag. A specially crafted packet sent by an attacker could cause a denial-of-service (DoS) condition.

Statement: The availability impact of this flaw is limited to applications using libmicrohttpd. Red Hat host operating systems are not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
comedi: fix divide-by-zero in comedi_buf_munge()
CVE: CVE-2025-40106
Component: kernel
Severity: None
Release date: 2025-10-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

comedi: fix divide-by-zero in comedi_buf_munge()

The comedi_buf_munge() function performs a modulo operation
`async->munge_chan %= async->cmd.chanlist_len` without first
checking if chanlist_len is zero. If a user program submits a command with
chanlist_len set to zero, this causes a divide-by-zero error when the device
processes data in the interrupt handler path.

Add a check for zero chanlist_len at the beginning of the
function, similar to the existing checks for !map and
CMDF_RAWDATA flag. When chanlist_len is zero, update
munge_count and return early, indicating the data was
handled without munging.

This prevents potential kernel panics from malformed user commands.


Remediation:
Django SQL injection
CVE: CVE-2025-64459
Component: django
CWE: CWE-89
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Release date: 2025-11-05T15:09:58.239000+00:00

A potential SQL injection vulnerability has been discovered in the Django web framework. The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q() were subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.

Statement: The impact of this vulnerability on Red Hat products is limited to the effective user scope of the running process.

Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrading
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service due to improper permission checks in genl_bind()
CVE: CVE-2025-39926
Component: kernel
CWE: CWE-266
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

genetlink: fix genl_bind() invoking bind() after -EPERM

Per family bind/unbind callbacks were introduced to allow families
to track multicast group consumer presence, e.g. to start or stop
producing events depending on listeners.

However, in genl_bind() the bind() callback was invoked even if
capability checks failed and ret was set to -EPERM. This means that
callbacks could run on behalf of unauthorized callers while the
syscall still returned failure to user space.

Fix this by only invoking bind() after "if (ret) break;" check
i.e. after permission checks have succeeded.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Libtiff Null Pointer Dereference Vulnerability
CVE: CVE-2025-8534
Component: libtiff
CWE: CWE-476
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-08-04T23:32:08.491000+00:00

A flaw was found in libtiff. The `PS_Lvl2page` function in `tiff2ps.c` exhibits a null pointer dereference due to improper handling of input data, potentially allowing a local attacker to trigger a denial of service via a crafted file. This manipulation results in the program attempting to access invalid memory locations. This vulnerability stems from a lack of sufficient validation of data structures.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
CVE: CVE-2025-38634
Component: kernel
Severity: None
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

power: supply: cpcap-charger: Fix null check for power_supply_get_by_name

In the cpcap_usb_detect() function, the power_supply_get_by_name()
function may return `NULL` instead of an error pointer.
To prevent potential null pointer dereferences, Added a null check.


Remediation:
ALSA: firewire-motu: add bounds check in put_user loop for DSP events
CVE: CVE-2025-68753
Component: kernel
CWE: CWE-787
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A buffer overwrite vulnerability was found in the Linux kernel's ALSA firewire-motu driver. When handling DSP events, the put_user() loop copies event data to userspace without properly checking if the user buffer size is aligned to 4 bytes. If the buffer is misaligned, the copy operation can write beyond the intended buffer boundary.

Statement: This vulnerability requires local access and the presence of FireWire MOTU audio hardware. The overwrite occurs in userspace memory provided by the calling application, limiting the security impact. Standard Red Hat Enterprise Linux configurations do not typically include FireWire audio hardware support.

Remediation:
To mitigate this issue, prevent the snd_firewire_motu module from being loaded if MOTU FireWire audio devices are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error
CVE: CVE-2025-22110
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error

It is possible that ctx in nfqnl_build_packet_message() could be used
before it is properly initialize, which is only initialized
by nfqnl_get_sk_secctx().

This patch corrects this problem by initializing the lsmctx to a safe
value when it is declared.

This is similar to the commit 35fcac7a7c25
("audit: Initialize lsmctx to avoid memory allocation error").


Remediation:
Linux kernel: Denial of Service via MPTCP race condition
CVE: CVE-2025-71088
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) subflow. A local attacker with high system privileges could exploit a race condition during simultaneous connection attempts. This issue allows the system's TCP subflow to enter an inconsistent state, bypassing a critical MPTCP security check. The inconsistent state can lead to a system crash, resulting in a Denial of Service (DoS), which means the system becomes unavailable to legitimate users.


Remediation:
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
CVE: CVE-2025-25285
Component: octokit/endpoint
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-02-14T19:31:44.827000+00:00

A flaw was found in the octokit/endpoint package for Node.js. In affected versions, the `endpoint.parse(options)` call can be triggered via specially-crafted `options` parameters, leading to a regular expression denial-of-service (ReDoS) attack. This causes the program to hang and results in high CPU utilization. The issue occurs in the `parse` function within the `parse.ts` file.


Remediation:
code execution when processing a malicious Transformer-XL model file
CVE: CVE-2025-14921
Component: transformers
CWE: CWE-502
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:04:23.187000+00:00

A flaw was found in the Hugging Face Transformers library. The parsing of model files fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious Transformer-XL model, resulting in arbitrary code execution in the context of the current user processing the file.

Statement: To exploit this issue, an attacker must convince a user to process a specially crafted Transformer-XL model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
To mitigate this issue, users should avoid processing Transformer-XL model files from untrusted or unverified sources. Ensure that all Transformer-XL model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.
platform/x86: intel: punit_ipc: fix memory corruption
CVE: CVE-2025-68303
Component: kernel
Severity: Moderate
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: intel: punit_ipc: fix memory corruption

This passes the address of the pointer "&punit_ipcdev" when the intent
was to pass the pointer itself "punit_ipcdev" (without the ampersand).
This means that the:

	complete(&ipcdev->cmd_complete);

in intel_punit_ioc() will write to a wrong memory address corrupting it.


Remediation:
iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED
CVE: CVE-2025-71122
Component: kernel
CWE: CWE-190
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

An integer overflow vulnerability was found in the Linux kernel's IOMMUFD selftest infrastructure. The IOMMU_TEST_OP_ADD_RESERVED ioctl does not properly validate user-supplied length values, allowing arithmetic overflow that corrupts the reserved interval tree and triggers a WARN_ON. This issue only affects test kernels compiled with CONFIG_IOMMUFD_TEST enabled.

Statement: This vulnerability exclusively affects development and testing kernels with CONFIG_IOMMUFD_TEST enabled, which is not enabled in production kernel builds. The selftest infrastructure is used for IOMMUFD driver development and validation. Production systems do not include this test code and are not affected by this issue.

Remediation:
Best Practical RT search URL XSS Vulnerability
CVE: CVE-2025-30087
Component: bestpractical.com/request-tracker
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-05-28T00:00:00+00:00

A flaw was found in Request Tracker. This vulnerability allows Cross-site scripting (XSS) via JavaScript injection into a search URL.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.