huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Firefox for Android opened URLs specified in a link querystring parameter
CVE: CVE-2025-6428
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-06-24T12:28:02.201000+00:00

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library
CVE: CVE-2025-40907
Component: perl-fcgi
CWE: CWE-1395
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-16T13:03:02.774000+00:00

A flaw was found in the FCGI library. In affected versions, specially crafted nameLen or valueLen values in data sent to the IPC socket may result in a heap-based buffer overflow, which can cause an application crash or other undefined behavior. This occurs in ReadParams in fcgiapp.c.

Statement: This vulnerability is Important rather than just a Moderate flaw because it stems from an integer overflow in the allocation size calculation during parameter parsing in the FastCGI implementation. When the application processes incoming FastCGI parameters, it calculates the total size of memory to allocate by adding the name and value lengths along with two additional bytes. On 32-bit systems, this arithmetic operation can wrap around (due to the limited 32-bit size of size_t), leading to a significantly smaller allocation than intended. However, subsequent calls to FCGX_GetStr use the original (large) lengths provided by the attacker and write far beyond the allocated memory region (heap overflow). Unlike a moderate vulnerability (e.g., memory leak or a simple read out-of-bounds), this heap overflow directly allows an attacker to overwrite adjacent memory in the heap in a controlled way, potentially leading to arbitrary code execution, data corruption, or privilege escalation.

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
CVE: CVE-2025-0905
Component: PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Release date: 2025-01-31T22:07:55.139000+00:00

PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of JB2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-25433.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Incus firewall rule bypass
CVE: CVE-2025-52890
Component: incus
CVSS v3: 7.2/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Release date: 2025-06-25T16:51:24.279000+00:00

A firewall bypass flaw has been discovered in Incus. When using an ACL on a device connected by a bridge, a set of nftables rules may be bypassed which can lead to ARP spoofing on the bridge.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
.NET: ASP.NET Core denial of service with HTTP/3
CVE: CVE-2025-26682
Component: dotnet
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-08T16:00:00+00:00

A flaw was found in dotnet. Improper use of the HTTP/3 protocol allows an unauthorized remote attacker to cause an allocation of resources without limits or throttling in ASP.NET Core, resulting in a denial of service.

Statement: This issue can only be exploited when support for the HTTP/3 protocol is enabled. The .NET packages shipped in Red Hat Enterprise Linux do not support the HTTP/3 protocol. Therefore, Red Hat products are not affected by this vulnerability.

```

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

```

Remediation:
LoongArch: KVM: Check validity of "num_cpu" from user space
CVE: CVE-2025-38366
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: KVM: Check validity of "num_cpu" from user space

The maximum supported cpu number is EIOINTC_ROUTE_MAX_VCPUS about
irqchip EIOINTC, here add validation about cpu number to avoid array
pointer overflow.


Remediation:
Assimp Out-of-Bounds Read Vulnerability
CVE: CVE-2025-5204
Component: assimp
CWE: CWE-125
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-26T20:31:06.524000+00:00

A flaw was found in assimp. The flawed bounds check in the MDLImporter::ParseSkinLump_3DGS_MDL7 function leads to an out-of-bounds read. A local attacker is required to trigger the vulnerability by manipulating input during file parsing. This results in a denial of service. Low privileges are needed to exploit the issue.


Remediation:
CVE: CVE-2025-7239
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:57:11.194000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26085.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/9p: Fix buffer overflow in USB transport layer
CVE: CVE-2025-40004
Component: kernel
Severity: None
Release date: 2025-10-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/9p: Fix buffer overflow in USB transport layer

A buffer overflow vulnerability exists in the USB 9pfs transport layer
where inconsistent size validation between packet header parsing and
actual data copying allows a malicious USB host to overflow heap buffers.

The issue occurs because:
- usb9pfs_rx_header() validates only the declared size in packet header
- usb9pfs_rx_complete() uses req->actual (actual received bytes) for
memcpy

This allows an attacker to craft packets with small declared size
(bypassing validation) but large actual payload (triggering overflow
in memcpy).

Add validation in usb9pfs_rx_complete() to ensure req->actual does not
exceed the buffer capacity before copying data.


Remediation:
out-of-bounds read in RV60 video decoder
CVE: CVE-2025-69693
Component: FFmpeg
CWE: CWE-125
Severity: Moderate
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the RV60 video decoder in FFmpeg. Processing a specially crafted RV60 file can cause an out-of-bounds read due to an improper bounds checking of the quantization parameter (QP), resulting in a limited information disclosure and denial of service.

Statement: To exploit this issue, an attacker needs to convince a user to process a specially crafted RV60 file. Also, the only security impact of this flaw is a limited information disclosure and a denial of service. There is no memory corruption or arbitrary command execution. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted RV60 files with FFmpeg. If FFmpeg is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization
CVE: CVE-2025-38736
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.

The PHY address should be masked to 5 bits (0-31). Without this
mask, invalid PHY addresses could be used, potentially causing issues
with MDIO bus operations.

Fix this by masking the PHY address with 0x1f (31 decimal) to ensure
it stays within the valid range.


Remediation:
body-parser denial of service
CVE: CVE-2025-13466
Component: body-parser
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-24T18:29:36.725000+00:00

body-parser is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel (ASUS HID): Use-after-free vulnerability allows arbitrary code execution or denial of service
CVE: CVE-2025-39824
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.6/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-09-16T00:00:00+00:00

A flaw was found in the Linux kernel's Human Interface Device (HID) subsystem, specifically within the ASUS HID driver. A local attacker with physical access could connect a specially crafted malicious HID device, such as an ASUS ROG N-Key keyboard, to trigger a use-after-free vulnerability. This occurs when a malformed descriptor causes the system to prematurely free memory that is later accessed. Successful exploitation of this flaw could lead to system instability, a denial of service (DoS), or potentially arbitrary code execution.

Statement: Exploiting this flaw requires that an attacker have physical access to the vulnerable system, and is able to connect a malicious input device.

Remediation:
cpp-httplib does not limit the length of a line
CVE: CVE-2025-53628
Component: cpp-httplib
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T19:45:54.960000+00:00

A memory exhaustion flaw has been discovered in cpp-httplib. cpp-httplib does not have a limit for a unique line, which permits an attacker to explore this to allocate memory arbitrarily.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FFmpeg: Heap-buffer-overflow in SANM (ANIM v0 variant) file frame decoding
CVE: CVE-2025-59730
Component: FFmpeg
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-06T08:09:11.029000+00:00

A flaw was found in FFmpeg. This vulnerability allows a heap-buffer-overflow via decoding a SANM (Software Audio and Music, ANIM v0 variant) file frame with run-length encoded data using codec 48, due to insufficient buffer size checks.

Statement: This flaw in FFmpeg can lead to a heap-buffer-overflow when processing a specially crafted SANM (ANIM v0 variant) file. The highest threat is to system availability, as an attacker on the same adjacent network could trigger a denial of service.

Remediation:
Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance"
CVE: CVE-2025-38673
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Revert "drm/gem-framebuffer: Use dma_buf from GEM object instance"

This reverts commit cce16fcd7446dcff7480cd9d2b6417075ed81065.

The dma_buf field in struct drm_gem_object is not stable over the
object instance's lifetime. The field becomes NULL when user space
releases the final GEM handle on the buffer object. This resulted
in a NULL-pointer deref.

Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on
GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer:
Acquire internal references on GEM handles") only solved the problem
partially. They especially don't work for buffer objects without a DRM
framebuffer associated.

Hence, this revert to going back to using .import_attach->dmabuf.

v3:
- cc stable

Statement: The reverted change avoids using obj->dma_buf, which can become NULL when userspace drops the final GEM handle, and switches back to the stable obj->import_attach->dmabuf. Without this, framebuffer CPU-access paths could dereference NULL and panic the kernel. Exploitation is local and requires DRM/KMS usage rights. This vulnerability can only be triggered by a local user with access to the graphical workstation, since it requires the ability to interact with the DRM subsystem (e.g., creating and managing GEM framebuffers).

Remediation:
To mitigate this issue, prevent module drm from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
iommu/amd/pgtbl: Fix possible race while increase page table level
CVE: CVE-2025-39961
Component: kernel
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2025-10-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd/pgtbl: Fix possible race while increase page table level

The AMD IOMMU host page table implementation supports dynamic page table levels
(up to 6 levels), starting with a 3-level configuration that expands based on
IOVA address. The kernel maintains a root pointer and current page table level
to enable proper page table walks in alloc_pte()/fetch_pte() operations.

The IOMMU IOVA allocator initially starts with 32-bit address and onces its
exhuasted it switches to 64-bit address (max address is determined based
on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU
driver increases page table level.

But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads
pgtable->[root/mode] without lock. So its possible that in exteme corner case,
when increase_address_space() is updating pgtable->[root/mode], fetch_pte()
reads wrong page table level (pgtable->mode). It does compare the value with
level encoded in page table and returns NULL. This will result is
iommu_unmap ops to fail and upper layer may retry/log WARN_ON.

CPU 0                                         CPU 1
------                                       ------
map pages                                    unmap pages
alloc_pte() -> increase_address_space()      iommu_v1_unmap_pages() -> fetch_pte()
  pgtable->root = pte (new root value)
                                             READ pgtable->[mode/root]
					       Reads new root, old mode
  Updates mode (pgtable->mode += 1)

Since Page table level updates are infrequent and already synchronized with a
spinlock, implement seqcount to enable lock-free read operations on the read path.

Statement: During address-space growth (increase_address_space()), the AMD IOMMU driver updated the root pointer and mode without readers synchronizing on a sequence counter. Concurrent fetch_pte() in unmap paths could see the new root with the old mode and return NULL, leading upper layers to fail unmaps and warn. The fix adds a seqcount around updates to allow lockless, consistent readers.

Remediation:
To mitigate this issue, prevent module amd_iommu from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Bluetooth: ISO: Fix possible UAF on iso_conn_free
CVE: CVE-2025-40141
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2025-11-12T00:00:00+00:00

A vulnerability was found in iso_sock_kill in net/bluetooth/iso.c in Bluetooth protocol stack in the Linux Kernel. In this flaw if the
conn->sk is not set to NULL may lead to UAF on iso_conn_free.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
DCMTK dcm2img diybrpxt.h memory corruption
CVE: CVE-2025-9732
Component: dcmtk
Release date: 2025-08-31T14:02:06.157000+00:00

A vulnerability was identified in DCMTK. This issue affects an unknown function in the dcmimage/include/dcmtk/dcmimage/diybrpxt.h library of the dcm2img component. Manipulation leads to memory corruption. Local access is required to approach this attack.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
CVE: CVE-2025-12762
Component: pgadmin4
CVSS v3: 7.5/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Release date: 2025-11-13T13:00:02.005000+00:00

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Remote Code Execution in jsonpath-plus via Improper Input Sanitization
CVE: CVE-2025-1302
Component: jsonpath-plus
CWE: CWE-94
Severity: Low
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-15T05:00:01.061000+00:00

A flaw was found in jsonpath-plus. This vulnerability allows remote code execution (RCE) via improper input sanitization, exploiting the unsafe default usage of eval='safe' mode.

Statement: Red Hat's initial impact rating of critical has been downgraded to low. While the vulnerable code is technically still present within Red Hat products, there are no code paths in affected products which allow exploitation. As such, the impact to Red Hat products is low.

Each of the products listed have multiple components where a fixed build could occur. This distinction does not matter for users as only one build needs fixed for the product. Additionally, in Red Hat OpenShift AI, jsonpath-plus is a dependency of a direct dependency and is never loaded, as the direct dependency's feature that requires jsonpath-plus is not used.

Remediation:
Fiber: Out-of-Bounds Slice Allocation Crash
CVE: CVE-2025-54801
Component: github.com/gofiber/fiber/v2
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-05T23:33:28.221000+00:00

A flaw was found in github.com/gofiber/fiber/v2. The `Ctx.BodyParser` function fails to properly validate numeric form keys, allowing a large integer value to be interpreted as a slice index. This flaw allows a remote attacker to trigger this condition by submitting a crafted form with a sufficiently large numeric key. This issue leads to panic within the application, potentially resulting in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.