huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
CVE: CVE-2025-40275
Component: kernel
CWE: CWE-252
Severity: Low
CVSS v3: 4.3/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-06T00:00:00+00:00

A null pointer dereference was found in the USB audio driver in the Linux kernel. For UAC3 devices, snd_usb_mixer_controls_badd() does not check if usb_ifnum_to_if() returns NULL before dereferencing the result. A malicious USB device with crafted descriptors can trigger this crash.

Statement: Physical access is required to connect a malicious USB device. The impact is limited to kernel crash (denial of service). This was discovered through syzkaller fuzzing with crafted USB descriptors.

Remediation:
ipv4: use RCU protection in __ip_rt_update_pmtu()
CVE: CVE-2025-21766
Component: kernel
CWE: CWE-413
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv4: use RCU protection in __ip_rt_update_pmtu()

__ip_rt_update_pmtu() must use RCU protection to make
sure the net structure it reads does not disappear.


Remediation:
Inappropriate implementation in Download
CVE: CVE-2025-12905
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-11-07T23:23:36.585000+00:00

Inappropriate implementation in Downloads in Google Chrome allowed a remote attacker to bypass Mark of the Web via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
CVE: CVE-2025-38547
Component: kernel
Severity: None
Release date: 2025-08-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps

The AXP717 ADC channel maps is missing a sentinel entry at the end. This
causes a KASAN warning.

Add the missing sentinel entry.


Remediation:
CVE: CVE-2025-8647
Component: Kenwood DMX958XR Firmware Update Command Injection Vulnerability
Release date: 2025-08-06T01:13:59.284000+00:00

Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. 

The specific flaw exists within the firmware update process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26270.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Apache Camel: Camel-Undertow Message Header Injection via Improper Filtering
CVE: CVE-2025-30177
Component: org.apache.camel/camel-undertow
CWE: CWE-164
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-04-01T11:56:30.484000+00:00

A flaw was found in the Apache Camel Undertow component. This vulnerability allows an attacker to inject Camel-specific headers via the inbound request, which can alter the behavior of certain Camel components such as camel-bean and camel-exec. This issue occurs due to the custom header filter strategy only applying to outgoing messages and not filtering incoming ones.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Integer overflow in V8
CVE: CVE-2025-10892
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-24T16:17:46.382000+00:00

Integer overflow vulnerability has been identified in V8 in Google Chrome that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Clickjacking the registerProtocolHandler info-bar  Reporter
CVE: CVE-2025-1935
Component: firefox
CWE: CWE-1021
Severity: Low
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2025-03-04T13:31:25.890000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A web page could trick a user into setting that site as the default handler for a custom URL protocol.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory

Remediation:
OpenEXR: Remote Code Execution via EXR file parsing heap-based buffer overflow
CVE: CVE-2025-12840
Component: OpenEXR
CWE: CWE-122
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-23T21:41:45.445000+00:00

A flaw was found in OpenEXR. This heap-based buffer overflow vulnerability occurs during EXR file parsing due to improper validation of user-supplied data length. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious EXR file. Successful exploitation could lead to arbitrary code execution in the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it is a heap-based buffer overflow in OpenEXR that could lead to arbitrary code execution. Exploitation requires user interaction, specifically opening a malicious EXR file or visiting a malicious page. Red Hat products are affected if they process untrusted EXR files.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are advised to exercise caution when opening untrusted EXR files or visiting untrusted web pages.
TOCTOU race in Linenoise enables arbitrary file overwrite and permission changes
CVE: CVE-2025-9810
Component: linenoise
CWE: CWE-367
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Release date: 2025-09-01T19:03:19.540000+00:00

A time-of-check to time-of-use (TOCTOU) race condition exists in linenoise's linenoiseHistorySave() function, where the history file is first opened with fopen("w") and subsequently modified with chmod(). This vulnerability allows a local attacker to manipulate a symbolic link between these two operations: first, pointing the symlink to a sensitive file at the time of opening, and then switching it to another file before the permission change. This flaw allows arbitrary file overwrite or unintended permission modifications.

Statement: This vulnerability allows a local, unauthenticated attacker to race linenoiseHistorySave() and overwrite arbitrary files with the calling process’s privileges or change permissions on unrelated files, potentially disrupting system integrity and availability. While the confidentiality impact is none, the integrity impact is high and the availability impact is low, yielding a Moderate severity of CVSS 6.8. Downstream tools that embed linenoise, such as redis-cli, are affected when writing history to attacker-controllable locations.

Remediation:
No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
HTTP Session Hijack via a TLS upgrade
CVE: CVE-2025-49812
Component: httpd
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-14T07:24:13.282000+00:00

An HTTP session hijacking flaw was found in Apache httpd. In some mod_ssl configurations on Apache HTTP Server, an HTTP desynchronization attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.

Statement: Only configurations using the \"SSLEngine optional\" to enable TLS upgrades are affected.

This vulnerability is rated Moderate rather than Important primarily due to the narrow scope of affected configurations and preconditions required for exploitation. Specifically, it only impacts Apache HTTP Server setups where SSLEngine optional is used—a rarely employed configuration that permits opportunistic TLS upgrades (also known as STARTTLS-style negotiation). For an attacker to successfully exploit this flaw, a man-in-the-middle (MitM) position is required, and the server must be using this optional TLS upgrade setup, which is uncommon and discouraged in modern secure deployments. The vulnerability arises due to HTTP desynchronization, allowing the attacker to potentially hijack sessions during the upgrade process.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link. You must be logged in to download the update.
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
bnxt_en: Shutdown FW DMA in bnxt_shutdown()
CVE: CVE-2025-40330
Component: kernel
Severity: Moderate
CVSS v3: 5.5/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Shutdown FW DMA in bnxt_shutdown()

The netif_close() call in bnxt_shutdown() only stops packet DMA.  There
may be FW DMA for trace logging (recently added) that will continue.  If
we kexec to a new kernel, the DMA will corrupt memory in the new kernel.

Add bnxt_hwrm_func_drv_unrgtr() to unregister the driver from the FW.
This will stop the FW DMA.  In case the call fails, call pcie_flr() to
reset the function and stop the DMA.

Statement: This vulnerability affects systems using Broadcom NetXtreme-C/E network adapters that perform kexec operations. The memory corruption occurs during the transition to a new kernel, making this particularly relevant for systems that rely on kexec for fast reboots or crash dump collection.

Remediation:
To mitigate this issue, prevent the bnxt_en module from being loaded if Broadcom NetXtreme-C/E network adapters are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
CVE: CVE-2025-21789
Component: kernel
CWE: CWE-125
Severity: Important
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: csum: Fix OoB access in IP checksum code for negative lengths

Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit
system") would cause an undefined shift and an out-of-bounds read.

Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code
for negative lengths") fixes the same issue on ARM64.


Remediation:
Use After Free in DevTools in Google Chrome
CVE: CVE-2025-0762
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-29T10:33:45.673000+00:00

A flaw was found in DevTools in Google Chrome. This vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-5833
Component: Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability
Release date: 2025-06-11T17:27:53.809000+00:00

Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the operating system. The issue results from the lack of properly configured protection for the root file system. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26077.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Nodejs filesystem permissions bypass
CVE: CVE-2025-55132
Component: nodejs
CWE: CWE-281
Severity: Low
CVSS v3: 2.9/CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A file access flaw has been discovered in NodeJS. A file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
w1: therm: Fix off-by-one buffer overflow in alarms_store
CVE: CVE-2025-71197
Component: kernel
Severity: None
Release date: 2025-01-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

w1: therm: Fix off-by-one buffer overflow in alarms_store

The sysfs buffer passed to alarms_store() is allocated with 'size + 1'
bytes and a NUL terminator is appended. However, the 'size' argument
does not account for this extra byte. The original code then allocated
'size' bytes and used strcpy() to copy 'buf', which always writes one
byte past the allocated buffer since strcpy() copies until the NUL
terminator at index 'size'.

Fix this by parsing the 'buf' parameter directly using simple_strtoll()
without allocating any intermediate memory or string copying. This
removes the overflow while simplifying the code.


Remediation:
Vault Identity Token Privilege Escalation
CVE: CVE-2025-5999
Component: github.com/hashicorp/vault
CWE: CWE-266
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-08-01T17:38:58.409000+00:00

A flaw was found in github.com/hashicorp/vault. This vulnerability allows a privileged Vault operator with write access to the root namespace’s identity endpoint to manipulate token privileges, effectively elevating another user’s token to the Vault root policy. This privilege escalation occurs through crafted writes to the identity endpoint. An attacker can obtain unauthorized root access to the Vault system, allowing complete control over the Vault instance.

Statement: This vulnerability is Important rather than Moderate because it enables direct privilege escalation to the Vault root policy, granting unrestricted administrative control over the entire Vault environment. While the attacker must already have write access to the root namespace’s identity endpoint, that permission alone does not normally confer root-level authority—this flaw breaks the intended privilege separation model. By exploiting it, an attacker can craft malicious writes to the identity endpoint to bind their own or another user’s token to the root policy, bypassing all policy restrictions. With root access, the attacker can exfiltrate every stored secret, modify or delete sensitive data, disable audit logs to cover tracks, and introduce persistent backdoors.

Remediation:
Until you can upgrade to a fixed release, mitigation options include applying Sentinel EGP policies to prevent assignment of the root policy via the identity API, and closely monitoring Vault audit logs for tokens with "identity_policies": ["root"].
Processing maliciously crafted web content may lead to memory corruption
CVE: CVE-2025-31273
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-08-01T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
aiomysql arbitrary access to client files
CVE: CVE-2025-62611
Component: aiomysql
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2025-10-22T19:29:26.708000+00:00

A file access flaw has been discovered in the aiomysql python library. In affected versions the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary files from the client by sending a LOAD_LOCAL instruction packet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()
CVE: CVE-2025-37831
Component: kernel
Severity: None
Release date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()

cpufreq_cpu_get_raw() can return NULL when the target CPU is not present
in the policy->cpus mask. apple_soc_cpufreq_get_rate() does not check
for this case, which results in a NULL pointer dereference.


Remediation:
Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server
CVE: CVE-2025-46421
Component: libsoup
CWE: CWE-497
Severity: Moderate
CVSS v3: 6.8/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2025-04-24T00:00:00+00:00

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.


Remediation:
Currently, no mitigation is available for this vulnerability.
appneta tcpreplay tcprewrite get.c get_l2len_protocol use after free
CVE: CVE-2025-9386
Component: tcpreplay
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-08-24T11:02:07.459000+00:00

A vulnerability has been found in appneta tcpreplay up to 4.5.1. The impacted element is the function get_l2len_protocol of the file get.c of the component tcprewrite. Such manipulation leads to use after free. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.2-beta3 is sufficient to resolve this issue. You should upgrade the affected component.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
MediaWiki: Low impact information disclosure for highly privileged users
CVE: CVE-2025-6589
Component: MediaWiki
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in MediaWiki. An authenticated user with high privileges could potentially exploit a vulnerability related to the `BlockListPager.Php` file. This could lead to a low impact on confidentiality, potentially disclosing limited information.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Text buffer overflow with long characters
CVE: CVE-2025-27831
Component: Ghostscript
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-03-25T00:00:00+00:00

A flaw was found in Artifex Ghostscript. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters to devices/vector/doc_common.c.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
jfs: upper bound check of tree index in dbAllocAG
CVE: CVE-2025-38697
Component: kernel
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

jfs: upper bound check of tree index in dbAllocAG

When computing the tree index in dbAllocAG, we never check if we are
out of bounds realative to the size of the stree.
This could happen in a scenario where the filesystem metadata are
corrupted.


Remediation: