huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
.NET Elevation of Privilege Vulnerability
CVE: CVE-2025-21173
Component: dotnet
CWE: CWE-379
Severity: Important
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-01-14T18:04:02.074000+00:00

An elevation of privilege vulnerability was found in .NET. This flaw allows an attacker to write a specially crafted file in the security context of the local system.

Statement: This vulnerability is rated with an Important severity because it allows an attacker to gain elevated privileges in the local system context. By exploiting this, an attacker can bypass standard user permissions, manipulate critical system files, execute arbitrary code, or install malicious software, potentially compromising the entire system.

```

.NET 6.0 for RHEL-8, RHEL-9 and RHIVOS has reached its End of Life as of November 12, 2024, and is no longer supported. No fixes will be provided for this stream. For additional information about lifecycle for .NET on Red Hat Enterprise Linux, please refer to: https://access.redhat.com/support/policy/updates/net-core.

```

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
QEMU SR-IOV Migration Inconsistency
CVE: CVE-2025-54566
Component: qemu-kvm
CWE: CWE-642
Severity: Moderate
CVSS v3: 4.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2025-07-25T00:00:00+00:00

A flaw was found in QEMU. A migration state inconsistency within the pcie_sriov emulation code allows an attacker with adjacent network access to trigger unexpected behavior. This condition arises from a state mismatch during migration processes, which can potentially lead to resource exhaustion. The vulnerability allows for exploitation via a malformed migration data stream. This  issue can result in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
idpf: cleanup remaining SKBs in PTP flows
CVE: CVE-2025-40175
Component: kernel
Severity: None
Release date: 2025-11-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: cleanup remaining SKBs in PTP flows

When the driver requests Tx timestamp value, one of the first steps is
to clone SKB using skb_get. It increases the reference counter for that
SKB to prevent unexpected freeing by another component.
However, there may be a case where the index is requested, SKB is
assigned and never consumed by PTP flows - for example due to reset during
running PTP apps.

Add a check in release timestamping function to verify if the SKB
assigned to Tx timestamp latch was freed, and release remaining SKBs.


Remediation:
wifi: rtw89: sar: drop lockdep assertion in rtw89_set_sar_from_acpi
CVE: CVE-2025-38647
Component: kernel
CWE: CWE-413
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: sar: drop lockdep assertion in rtw89_set_sar_from_acpi

The following assertion is triggered on the rtw89 driver startup. It
looks meaningless to hold wiphy lock on the early init stage so drop the
assertion.

 WARNING: CPU: 7 PID: 629 at drivers/net/wireless/realtek/rtw89/sar.c:502 rtw89_set_sar_from_acpi+0x365/0x4d0 [rtw89_core]
 CPU: 7 UID: 0 PID: 629 Comm: (udev-worker) Not tainted 6.15.0+ #29 PREEMPT(lazy)
 Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN50WW 09/27/2024
 RIP: 0010:rtw89_set_sar_from_acpi+0x365/0x4d0 [rtw89_core]
 Call Trace:
  <TASK>
  rtw89_sar_init+0x68/0x2c0 [rtw89_core]
  rtw89_core_init+0x188e/0x1e50 [rtw89_core]
  rtw89_pci_probe+0x530/0xb50 [rtw89_pci]
  local_pci_probe+0xd9/0x190
  pci_call_probe+0x183/0x540
  pci_device_probe+0x171/0x2c0
  really_probe+0x1e1/0x890
  __driver_probe_device+0x18c/0x390
  driver_probe_device+0x4a/0x120
  __driver_attach+0x1a0/0x530
  bus_for_each_dev+0x10b/0x190
  bus_add_driver+0x2eb/0x540
  driver_register+0x1a3/0x3a0
  do_one_initcall+0xd5/0x450
  do_init_module+0x2cc/0x8f0
  init_module_from_file+0xe1/0x150
  idempotent_init_module+0x226/0x760
  __x64_sys_finit_module+0xcd/0x150
  do_syscall_64+0x94/0x380
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Found by Linux Verification Center (linuxtesting.org).


Remediation:
infinite loop in readelf via crafted binary with malformed DWARF .debug_rnglists data
CVE: CVE-2025-69648
Component: binutils
CWE: CWE-835
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in binutils. Processing a specially crafted ELF binary file containing malformed DWARF .debug_rnglists data with the readelf program can trigger an infinite loop and result in a denial of service.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this infinite loop is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with readelf. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Remediation:
To mitigate this vulnerability, do not process untrusted, unverified or externally supplied ELF binaries with the readelf program.
hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
CVE: CVE-2025-38217
Component: kernel
Severity: None
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ftsteutates) Fix TOCTOU race in fts_read()

In the fts_read() function, when handling hwmon_pwm_auto_channels_temp,
the code accesses the shared variable data->fan_source[channel] twice
without holding any locks. It is first checked against
FTS_FAN_SOURCE_INVALID, and if the check passes, it is read again
when used as an argument to the BIT() macro.

This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition.
Another thread executing fts_update_device() can modify the value of
data->fan_source[channel] between the check and its use. If the value
is changed to FTS_FAN_SOURCE_INVALID (0xff) during this window, the
BIT() macro will be called with a large shift value (BIT(255)).
A bit shift by a value greater than or equal to the type width is
undefined behavior and can lead to a crash or incorrect values being
returned to userspace.

Fix this by reading data->fan_source[channel] into a local variable
once, eliminating the race condition. Additionally, add a bounds check
to ensure the value is less than BITS_PER_LONG before passing it to
the BIT() macro, making the code more robust against undefined behavior.

This possible bug was found by an experimental static analysis tool
developed by our team.


Remediation:
UPX p_lx_elf.cpp un_DT_INIT heap-based overflow
CVE: CVE-2025-2849
Component: upx
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-27T13:31:06.442000+00:00

A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
CVE: CVE-2025-21935
Component: kernel
Severity: None
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rapidio: add check for rio_add_net() in rio_scan_alloc_net()

The return value of rio_add_net() should be checked.  If it fails,
put_device() should be called to free the memory and give up the reference
initialized in rio_add_net().


Remediation:
Elasticsearch: User impersonation due to improper authentication in Public Key Infrastructure (PKI) realm
CVE: CVE-2025-37731
Component: elasticsearch
CWE: CWE-287
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2025-12-15T10:42:21.840000+00:00

A flaw was found in Elasticsearch. This vulnerability allows user impersonation via specially crafted client certificates signed by a legitimate, trusted Certificate Authority (CA).

Statement: This vulnerability is rated Moderate for Red Hat because it allows user impersonation in Elasticsearch PKI realm. Exploitation requires a malicious actor to possess a specially crafted client certificate signed by a legitimate, trusted Certificate Authority. This impacts Elasticsearch deployments configured with PKI authentication.

Remediation:
To reduce the risk of exploitation, ensure that the Certificate Authority (CA) used for the Elasticsearch PKI realm is highly secured and has robust controls in place to prevent the signing of unauthorized client certificates. Additionally, restrict network access to the Elasticsearch instance to only trusted clients and networks, for example, by configuring firewall rules to limit inbound connections to the Elasticsearch port.
Apache HTTP Server Memory Exhaustion
CVE: CVE-2025-53020
Component: httpd
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-10T16:59:06.340000+00:00

A memory exhaustion flaw has been discovered in the Apache HTTP server. In some instances, the Apache HTTP server fails to free memory. Given sufficient time, this may lead to the host operating system killing the web server in order to reclaim memory.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: cadence: macb: Fix a possible deadlock in macb_halt_tx.
CVE: CVE-2025-38094
Component: kernel
Severity: None
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: cadence: macb: Fix a possible deadlock in macb_halt_tx.

There is a situation where after THALT is set high, TGO stays high as
well. Because jiffies are never updated, as we are in a context with
interrupts disabled, we never exit that loop and have a deadlock.

That deadlock was noticed on a sama5d4 device that stayed locked for days.

Use retries instead of jiffies so that the timeout really works and we do
not have a deadlock anymore.


Remediation:
CVE: CVE-2025-14401
Component: PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-12-11T20:58:26.137000+00:00

PDFsam Enhanced App Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27260.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
use-after-free with key data stored cross-RVT
CVE: CVE-2025-10911
Component: libxslt
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-08-04T00:00:00+00:00

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.


Remediation:
coresight: tmc: add the handle of the event to the path
CVE: CVE-2025-68370
Component: kernel
Severity: None
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

coresight: tmc: add the handle of the event to the path

The handle is essential for retrieving the AUX_EVENT of each CPU and is
required in perf mode. It has been added to the coresight_path so that
dependent devices can access it from the path when needed.

The existing bug can be reproduced with:
perf record -e cs_etm//k -C 0-9 dd if=/dev/zero of=/dev/null

Showing an oops as follows:
Unable to handle kernel paging request at virtual address 000f6e84934ed19e

Call trace:
 tmc_etr_get_buffer+0x30/0x80 [coresight_tmc] (P)
 catu_enable_hw+0xbc/0x3d0 [coresight_catu]
 catu_enable+0x70/0xe0 [coresight_catu]
 coresight_enable_path+0xb0/0x258 [coresight]


Remediation:
cifs: Fix memory and information leak in smb3_reconfigure()
CVE: CVE-2025-71151
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A memory and information leak vulnerability was found in the Linux kernel's CIFS/SMB3 filesystem driver. When smb3_reconfigure() fails during smb3_sync_session_ctx_passwords(), the newly allocated password buffers (new_password and new_password2) are not freed or securely erased. This causes a memory leak and leaves sensitive password data in kernel memory that could potentially be exposed.

Statement: This vulnerability affects systems using CIFS/SMB3 filesystem mounts with password-based authentication. The password buffers remain in kernel memory after the error, creating an information disclosure risk if kernel memory can be read through other means. The memory leak accumulates with each failed reconfigure operation.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
comedi: pcl726: Prevent invalid irq number
CVE: CVE-2025-39685
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

comedi: pcl726: Prevent invalid irq number

The reproducer passed in an irq number(0x80008000) that was too large,
which triggered the oob.

Added an interrupt number check to prevent users from passing in an irq
number that was too large.

If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid
because it shifts a 1-bit into the sign bit (which is UB in C).
Possible solutions include reducing the upper bound on the
`it->options[1]` value to 30 or lower, or using `1U << it->options[1]`.

The old code would just not attempt to request the IRQ if the
`options[1]` value were invalid.  And it would still configure the
device without interrupts even if the call to `request_irq` returned an
error.  So it would be better to combine this test with the test below.


Remediation:
Jakarta Mail SMTP Injection Vulnerability
CVE: CVE-2025-7962
Component: com.sun.mail/jakarta.mail
CWE: CWE-147
Severity: Moderate
CVSS v3: 5.4/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2025-07-21T17:22:12.520000+00:00

A flaw was found in com.sun.mail/jakarta.mail. The jakarta.mail component allows an attacker to inject SMTP messages by exploiting improper handling of carriage return and newline characters encoded in UTF-8. An unauthenticated attacker can leverage this vulnerability to send arbitrary SMTP messages. This injection occurs via crafted email content, potentially leading to unauthorized message transmission.

Statement: The assigned Moderate severity reflects that while the vulnerability can be exploited remotely, it requires an attacker to have some level of privilege on the system. The impact is primarily on the integrity of email messages, without affecting confidentiality or availability. This aligns with Red Hat's definition of a Moderate impact flaw, where exploitation is more difficult but could still lead to a compromise of resource integrity under specific circumstances.

This vulnerability affects Jakarta Mail v2.2. The affected version of Jakarta Mail is not shipped in Red Hat products.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use-after-free when creating a MPEG1/2 elementary stream (SETUP)
CVE: CVE-2025-65407
Component: live555
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-12-01T00:00:00+00:00

A flaw was found in Live555. A use-after-free issue in MPEG1or2Demux::newElementaryStream() allows attackers to cause a denial of service via a specially crafted MPEG program stream.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot
CVE: CVE-2025-68235
Component: kernel
Severity: None
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nouveau/firmware: Add missing kfree() of nvkm_falcon_fw::boot

nvkm_falcon_fw::boot is allocated, but no one frees it. This causes a
kmemleak warning.

Make sure this data is deallocated.


Remediation:
CVE: CVE-2025-12490
Component: Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability
Release date: 2025-10-30T21:00:56.700000+00:00

Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability.

The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28085.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2025-43535
Component: webkitgtk
CWE: CWE-119
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-17T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
LangChain: Arbitrary Code Execution via Serialization Injection
CVE: CVE-2025-68665
Component: langchain-core
CWE: CWE-502
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2025-12-23T22:56:04.837000+00:00

A flaw was found in LangChain. A remote attacker could exploit a serialization injection vulnerability in the `toJSON()` method. This occurs because the method fails to properly escape objects containing 'lc' keys during serialization of free-form data. When user-controlled data includes this key structure, it is incorrectly processed as a legitimate LangChain object during deserialization, which could lead to arbitrary code execution.

Statement: This vulnerability is rated Important for Red Hat products. A serialization injection flaw in LangChain's `toJSON()` method allows a remote attacker to achieve arbitrary code execution. This occurs when user-controlled data containing specific 'lc' key structures is improperly processed as a legitimate LangChain object during deserialization.

Remediation:
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.