huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ksmbd: add free_transport ops in ksmbd connection
CVE: CVE-2025-38325
Component: kernel
Severity: None
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add free_transport ops in ksmbd connection

free_transport function for tcp connection can be called from smbdirect.
It will cause kernel oops. This patch add free_transport ops in ksmbd
connection, and add each free_transports for tcp and smbdirect.


Remediation:
Components Services unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30715
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:31:11.982000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
OpenSSH SSHD Agent Forwarding and X11 Forwarding
CVE: CVE-2025-32728
Component: openssh
CWE: CWE-440
Severity: Moderate
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2025-04-10T00:00:00+00:00

A flaw was found in OpenSSH. In affected versions of sshd, the DisableForwarding directive does not fully adhere to the intended functionality as documented. Specifically, it fails to disable X11 and agent forwarding, which may allow unintended access under certain configurations.


Remediation:
To mitigate this vulnerability, explicitly disable X11 and agent forwarding in your SSH configuration (sshd_config) using:

X11Forwarding no
AllowAgentForwarding no
ZuluCrypt PolicyKit Privilege Escalation
CVE: CVE-2025-53391
Component: zulucrypt
CVSS v3: 9.2/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2025-06-28T00:00:00+00:00

A flaw was found in zulucrypt. Misconfigured PolicyKit allows settings within the CMakeLists.txt file to permit a local user to elevate their privileges to root. This insecure configuration bypasses authorization checks, allowing unauthorized actions. The vulnerability is triggered by the PolicyKit authorization process itself, requiring no external input. Consequently, a local attacker can gain root access without authentication.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
io_uring/waitid: always prune wait queue entry in io_waitid_wait()
CVE: CVE-2025-40047
Component: kernel
CWE: CWE-662
Severity: Moderate
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-10-28T00:00:00+00:00

A flaw use after free in the Linux kernel IO_URING subsystem was found in the way local user uses io_uring interface (using IORING_OP_WAITID).
A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

Statement: io_waitid_wait() didn’t always prune the wait-queue entry on success when a cancellation was in progress, leaving the entry on the list and racing with another callback, which could lead to double callbacks and list corruption (potential UAF).
The IO_URING enabled only in latest versions of Red Hat Enterprise Linux (from 9.3).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Flask Session Signing Fallback Key Vulnerability
CVE: CVE-2025-47278
Component: flask
CWE: CWE-683
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-05-13T15:57:40.409000+00:00

A flaw was found in Flask. This vulnerability allows sessions to be signed with stale keys via incorrect fallback key configuration.


Remediation:
Denial of Service in OSV-SCALIBR
CVE: CVE-2025-13425
Component: github.com/google/osv-scalibr
CWE: CWE-476
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-11-20T15:30:31.256000+00:00

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2025-8475
Component: Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability
Release date: 2025-08-01T17:37:56.804000+00:00

Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device.

The specific flaw exists within the implementation of the AVRCP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26321.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: nft_set_pipapo: fix null deref for empty set
CVE: CVE-2025-39867
Component: kernel
Release date: 2025-09-23T00:00:00+00:00

No description is available for this CVE.

Statement: This CVE has been marked as Rejected by the assigning CNA.

Remediation:
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
CVE: CVE-2025-64518
Component: cyclonedx-core-java
CWE: CWE-611
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-11-10T22:08:06.229000+00:00

An XML External Entity (XXE) injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM (XML) is validated, external XML entities can be processed (XXE), allowing an attacker to cause the application to disclose local files or make requests to internal network resources. This can occur when untrusted BOM XML is parsed or validated by the library.

Statement: The flaw has been rated High severity, because a remote attacker could craft a malicious CycloneDX SBOM that, when validated by an affected system, may result in disclosure of sensitive information from local files or internal network resources. Exploitation does not require authentication or user interaction, but it depends on the application accepting and processing untrusted CycloneDX XML input, the environments that automatically ingest SBOMs from external or untrusted sources.

~~~

This issue was introduced in cyclonedx-core-java v2.1.0 via commit https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9.

This vulnerability is related to, but distinct from, the previously fixed CVE-2024-38374, which addressed a similar XML External Entity (XXE) flaw in the SBOM parsing logic. That earlier fix secured the XML parser but did not cover the separate validation process, leaving this secondary XXE path unprotected. This new CVE closes that remaining gap by securing the XML validator used during schema validation.

~~~
~~~

For rhint-camel-spring-boot-4, the impact is assessed as Low.
The vulnerable component (cyclonedx-core-java) is part of the build-time plugin (cyclonedx-maven-plugin) used to generate SBOM metadata. That plugin runs only during the build, and is not included, shipped, or executed at runtime in the delivered product. Consequently, the vulnerability does not affect runtime behavior or security of deployed instances, and cannot be exploited in customer environments.

~~~

Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Reject or block XML-formatted BOMs from untrusted sources before handing them to the library (e.g., require BOMs to be JSON or only accept BOMs from trusted origins).
org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang
CVE: CVE-2025-48924
Component: commons-lang/commons-lang
CWE: CWE-674
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-11T14:56:58.049000+00:00

An uncontrolled recursion flaw was found in the Apache Commons Lang library. The ClassUtils.getClass(...) method can throw a StackOverflowError on very long inputs. Since this error is typically not handled by applications and libraries, a StackOverflowError may lead to the termination of an application.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
block: fix queue freeze vs limits lock order in sysfs store methods
CVE: CVE-2025-21807
Component: kernel
CWE: CWE-833
Severity: Low
CVSS v3: 4.2/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

block: fix queue freeze vs limits lock order in sysfs store methods

queue_attr_store() always freezes a device queue before calling the
attribute store operation. For attributes that control queue limits, the
store operation will also lock the queue limits with a call to
queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may
need to issue commands to a device to obtain limit values from the
hardware with the queue limits locked. This creates a potential ABBA
deadlock situation if a user attempts to modify a limit (thus freezing
the device queue) while the device driver starts a revalidation of the
device queue limits.

Avoid such deadlock by not freezing the queue before calling the
->store_limit() method in struct queue_sysfs_entry and instead use the
queue_limits_commit_update_frozen helper to freeze the queue after taking
the limits lock.

This also removes taking the sysfs lock for the store_limit method as
it doesn't protect anything here, but creates even more nesting.
Hopefully it will go away from the actual sysfs methods entirely soon.

(commit log adapted from a similar patch from  Damien Le Moal)


Remediation:
9p/net: fix improper handling of bogus negative read/write replies
CVE: CVE-2025-37879
Component: kernel
CWE: CWE-681
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

9p/net: fix improper handling of bogus negative read/write replies

In p9_client_write() and p9_client_read_once(), if the server
incorrectly replies with success but a negative write/read count then we
would consider written (negative) <= rsize (positive) because both
variables were signed.

Make variables unsigned to avoid this problem.

The reproducer linked below now fails with the following error instead
of a null pointer deref:
9pnet: bogus RWRITE count (4294967295 > 3)


Remediation:
Chromium integer overflow
CVE: CVE-2025-6191
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-06-18T18:16:36.095000+00:00

An integer overflow flaw was found in Google Chrome. This flaw may allow an attacker to trigger out-of-bounds memory access via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component
CVE: CVE-2025-10527
Component: firefox
CWE: CWE-416
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-16T12:26:35.079000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Graphics.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ice: fix PTP cleanup on driver removal in error path
CVE: CVE-2025-68215
Component: kernel
CWE: CWE-772
Severity: Important
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A resource leak and potential use-after-free was found in the Intel ice network driver in the Linux kernel. When PTP initialization fails or during reset errors, PTP resources are not properly cleaned up. This leaves dangling pointers in the ice_adapter port list, triggering warnings when the adapter is freed.

Statement: Intel E810 and similar Ethernet adapters with PTP support are affected. The issue manifests during error handling in driver probe, reset, or NVM update operations. Clean shutdown paths are not affected.

Remediation:
sudo-rs: File Existence Information Disclosure
CVE: CVE-2025-46717
Component: sudo-rs
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-05-12T14:52:55.408000+00:00

A flaw was found in sudo-rs. This vulnerability allows discovery of file existence via the `--list` command, which can reveal sensitive information.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence
CVE: CVE-2025-22006
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw: Fix NAPI registration sequence

Registering the interrupts for TX or RX DMA Channels prior to registering
their respective NAPI callbacks can result in a NULL pointer dereference.
This is seen in practice as a random occurrence since it depends on the
randomness associated with the generation of traffic by Linux and the
reception of traffic from the wire.


Remediation:
vtk: Kitware VTK: Buffer Overflow in GLTF accessor data processing
CVE: CVE-2025-57106
Component: Kitware VTK
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-31T00:00:00+00:00

A flaw was found in Kitware VTK (Visualization Toolkit). This vulnerability allows a buffer overflow via processing GLTF (Graphics Language Transmission Format) accessor data in the vtkGLTFDocumentLoader's BufferDataExtractionWorker template function.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Open Asset Import Library Assimp AC3D File ACLoader.cpp ConvertObjectSection heap-based overflow
CVE: CVE-2025-2756
Component: assimp
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-03-25T09:31:04.310000+00:00

A flaw was found in the Open Asset Import Library Assimp. This affects the Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component. The manipulation of the tmp argument can lead to a heap-based buffer overflow. It is possible to initiate the attack remotely.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
CVE: CVE-2025-21780
Component: kernel
CWE: CWE-120
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

It malicious user provides a small pptable through sysfs and then
a bigger pptable, it may cause buffer overflow attack in function
smu_sys_set_pp_table().


Remediation:
iommufd: Don't overflow during division for dirty tracking
CVE: CVE-2025-40293
Component: kernel
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-08T00:00:00+00:00

A divide-by-zero vulnerability was found in the iommufd dirty tracking code in the Linux kernel. When pgshift is 63, an integer overflow causes the divisor to become zero, triggering a kernel crash. This occurs during dirty bitmap index calculations for IOMMU operations.

Statement: iommufd is used for userspace IOMMU management, primarily in virtualization contexts. Triggering requires specific pgshift values of 63, which is an edge case unlikely in normal operation.

Remediation:
Google Chrome V8 Type Confusion: Arbitrary Code Execution via Crafted HTML Page
CVE: CVE-2025-0291
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-08T18:42:28.608000+00:00

Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
drm/amdgpu: fix nullptr err of vm_handle_moved
CVE: CVE-2025-40339
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix nullptr err of vm_handle_moved

If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL.
So, such kind of amdgpu_bo_va should be updated separately before
amdgpu_vm_handle_moved.

Statement: This vulnerability affects systems with AMD GPUs using the amdgpu driver. Exploitation requires local access and the ability to interact with AMD GPU virtual memory management. The impact is limited to denial of service through a kernel crash.

Remediation:
SignatureValue not checked within SignerInfo
CVE: CVE-2025-43903
Component: poppler
CWE: CWE-347
Severity: Moderate
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2025-04-18T00:00:00+00:00

A flaw was found in Poppler. For signatures with non-empty encapsulated content, typically adbe.pkcs7.sha1, it would only compare hash values, and SignatureValue was never checked within SignerInfo. This issue could lead to signature forgeries.


Remediation:
nbconvert: Arbitrary code execution via malicious SVG to PDF conversion on Windows
CVE: CVE-2025-53000
Component: nbconvert
CWE: CWE-427
Severity: Important
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-17T20:27:59.578000+00:00

A flaw was found in nbconvert, specifically in the jupyter nbconvert tool on Windows. A third party can exploit this vulnerability by creating a malicious inkscape.bat file in a directory. When a user then converts a Jupyter notebook containing SVG output to a PDF from this directory, the malicious inkscape.bat file is unexpectedly executed, leading to arbitrary code execution.

Statement: This vulnerability affects the nbconvert tool only when running on Windows environment, given that information there's no supported Red Hat product affected by this flaw.

Remediation: