huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`
CVE: CVE-2025-3416
Component: rust-openssl
CWE: CWE-416
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-04-04T20:31:08+00:00

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Salt Master authentication protocol downgrade may enable minion impersonation
CVE: CVE-2025-62349
Component: salt
CVSS v3: 6.8/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Release date: 2025-01-01T00:00:00+00:00

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()
CVE: CVE-2025-22107
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()

There are actually 2 problems:
- deleting the last element doesn't require the memmove of elements
  [i + 1, end) over it. Actually, element i+1 is out of bounds.
- The memmove itself should move size - i - 1 elements, because the last
  element is out of bounds.

The out-of-bounds element still remains out of bounds after being
accessed, so the problem is only that we touch it, not that it becomes
in active use. But I suppose it can lead to issues if the out-of-bounds
element is part of an unmapped page.


Remediation:
FontForge: Remote Code Execution via SFD File Parsing Heap-based Buffer Overflow
CVE: CVE-2025-15274
Component: fontforge
CWE: CWE-122
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-12-31T06:59:09.163000+00:00

A flaw was found in FontForge. This heap-based buffer overflow vulnerability allows a remote attacker to execute arbitrary code on an affected system. This occurs when a user is tricked into opening a specially crafted SFD file, due to improper validation of user-supplied data length during file parsing. Successful exploitation can lead to complete control over the affected system.

Statement: This vulnerability is rated Important for Red Hat products as it allows for remote code execution. Exploitation requires user interaction, where a target must open a specially crafted SFD file. This affects installations of FontForge on Red Hat Enterprise Linux and Fedora.

Remediation:
To mitigate this issue, users should avoid opening untrusted SFD (Spline Font Database) files with FontForge. If FontForge is not required, consider removing the package to eliminate the attack surface.
To remove FontForge on Red Hat Enterprise Linux or Fedora:
`sudo dnf remove fontforge`
Note that removing FontForge may impact other applications that depend on it for font manipulation.
bpf: Free special fields when update [lru_,]percpu_hash maps
CVE: CVE-2025-68744
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Free special fields when update [lru_,]percpu_hash maps

As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing
calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could cause the
memory referenced by BPF_KPTR_{REF,PERCPU} fields to be held until the
map gets freed.

Fix this by calling 'bpf_obj_free_fields()' after
'copy_map_value[,_long]()' in 'pcpu_copy_value()'.


Remediation:
Linux kernel (erofs): Denial of Service via corrupted subpage compact indexes
CVE: CVE-2025-68251
Component: kernel
CWE: CWE-835
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel's erofs filesystem. A local user can exploit this vulnerability by providing a crafted image with corrupted subpage compact indexes. This can lead to an infinite loop within the kernel, resulting in a Denial of Service (DoS).


Remediation:
ublk: clean up user copy references on ublk server exit
CVE: CVE-2025-71070
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-01-01T00:00:00+00:00

A reference count leak flaw was found in the Linux kernel's ublk (userspace block driver) subsystem. When a ublk server process exits while requests are still pending, the reference counts for those requests are not properly decremented. This leads to WARN_ON_ONCE warnings and could potentially allow stale operations on completed requests.

Statement: The ublk subsystem is a relatively new feature for userspace block device implementations. This bug triggers kernel warnings rather than crashes, and exploitation would require a malicious or buggy ublk server application. Systems not using ublk devices are completely unaffected.

Remediation:
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation
CVE: CVE-2025-1094
Component: postgresql
CWE: CWE-149
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-13T13:00:02.061000+00:00

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when `client_encoding` is `BIG5` and `server_encoding` is one of `EUC_TW` or `MULE_INTERNAL`.

Statement: This vulnerability is marked as Important because it not only enables SQL injection but also allows arbitrary code execution (ACE) through PostgreSQL’s psql interactive tool. The flaw arises from improper neutralization of malformed UTF-8 sequences, which can bypass PostgreSQL’s escaping functions, leading to successful injection attacks. What elevates its severity is psql's support for meta-commands, specifically the ! command, which allows execution of arbitrary shell commands on the host system.

Even when untrusted input is correctly escaped (e.g., via pg_escape_string), an attacker can craft invalid UTF-8 characters containing raw bytes like 0x27 (a single quote), causing psql to misinterpret the SQL statement’s structure. This allows splitting a single query into multiple statements, enabling unauthenticated attackers to execute arbitrary SQL meta-commands (e.g., \! <OS command>) or inject malicious SQL.

Remediation:
To mitigate, apply PostgreSQL patches once available. Until then:

1. Validate UTF-8 encoding: Reject inputs containing invalid UTF-8 sequences before passing to psql.
2. Avoid dynamic SQL: Use parameterized queries or ORM frameworks to minimize direct psql usage with raw input.
3. Restrict psql privileges: Limit OS-level permissions for the PostgreSQL user to reduce RCE impact.
4. Monitor logs: Flag repeated invalid byte sequence for encoding "UTF8" errors, which may indicate exploitation attempts.
ksmbd: add bounds check for create lease context
CVE: CVE-2025-22042
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add bounds check for create lease context

Add missing bounds check for create lease context.


Remediation:
CVE: CVE-2025-15331
Component: Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
Release date: 2025-04-16T00:00:00+00:00

Tanium addressed an uncontrolled resource consumption vulnerability in Connect.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick Stack Buffer Overflow
CVE: CVE-2025-53101
Component: ImageMagick
CWE: CWE-124
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Release date: 2025-07-14T19:51:53.338000+00:00

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick mogrify` command, specifying multiple consecutive `%d` format specifiers in a filename template causes internal pointer arithmetic to generate an address below the beginning of the stack buffer, resulting in a stack overflow through `vsnprintf()`. Versions 7.1.2-0 and 6.9.13-26 fix the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
CVE: CVE-2025-0685
Component: grub2
CWE: CWE-787
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-02-18T18:00:00+00:00

A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_jfs_lookup_symlink() function will write past the internal buffer length during grub_jfs_read_file(). This issue can be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution, by-passing secure boot protections.

Statement: Red Hat supported products are not affected by this vulnerability,as the grub2 versions as shipped with it does not include the JFS filesystem module.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Bootstrap XSS Vulnerability
CVE: CVE-2025-1647
Component: bootstrap
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-05-15T16:26:07.587000+00:00

A security vulnerability has been identified in the Bootstrap framework. This flaw allows for the execution of arbitrary JavaScript code within a user's web browser. This can occur when user-supplied input is not properly sanitized during the generation of web pages utilizing Bootstrap components. Successful exploitation could enable attackers to perform a variety of client-side attacks, potentially leading to data theft, session hijacking, defacement, or other malicious activities within the context of the affected user's browser session.


Remediation:
Visiting a malicious website may lead to address bar spoofing
CVE: CVE-2025-43228
Component: webkitgtk
CWE: CWE-451
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2025-08-01T00:00:00+00:00

A flaw was found in WebKitGTK. A malicious website can manipulate the address bar, potentially misleading users about the website they are visiting due to UI issues.

Statement: To exploit this flaw, an attacker needs to trick a user into visiting a malicious website.

Remediation:
Do not visit untrusted websites. Also, do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Linux kernel blk-cgroup: Denial of Service due to circular locking dependency
CVE: CVE-2025-68178
Component: kernel
CWE: CWE-833
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel's blk-cgroup component. A local user could trigger a circular locking dependency, leading to a deadlock. This deadlock occurs when the queue_usage_counter is acquired while the rq_qos_mutex is already held, which can result in a Denial of Service (DoS) for the affected system.


Remediation:
ptp: Ensure info->enable callback is always set
CVE: CVE-2025-21814
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ptp: Ensure info->enable callback is always set

The ioctl and sysfs handlers unconditionally call the ->enable callback.
Not all drivers implement that callback, leading to NULL dereferences.
Example of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c.

Instead use a dummy callback if no better was specified by the driver.


Remediation:
Header parser of http stream wrapper does not handle folded headers
CVE: CVE-2025-1217
Component: php
CWE: CWE-20
Severity: Moderate
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-03-29T05:19:33.696000+00:00

A flaw was found in PHP. This vulnerability allows misinterpretation of HTTP response headers, potentially leading to incorrect usage of headers, MIME types, and other response attributes via incorrect parsing of folded headers in the HTTP request module.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
stack overflow in d_print_comp_inner() in cp-demangle.c
CVE: CVE-2025-66865
Component: binutils
CWE: CWE-121
Severity: Low
CVSS v3: 3.2/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-12-29T00:00:00+00:00

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a stack overflow in the d_print_comp_inner function in the cp-demangle.c file, causing a crash and resulting in a denial of service.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this stack overflow is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with cxxfilt. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
f2fs: fix UAF issue in f2fs_merge_page_bio()
CVE: CVE-2025-40054
Component: kernel
Severity: None
Release date: 2025-10-28T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix UAF issue in f2fs_merge_page_bio()

As JY reported in bugzilla [1],

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
pc : [0xffffffe51d249484] f2fs_is_cp_guaranteed+0x70/0x98
lr : [0xffffffe51d24adbc] f2fs_merge_page_bio+0x520/0x6d4
CPU: 3 UID: 0 PID: 6790 Comm: kworker/u16:3 Tainted: P    B   W  OE      6.12.30-android16-5-maybe-dirty-4k #1 5f7701c9cbf727d1eebe77c89bbbeb3371e895e5
Tainted: [P]=PROPRIETARY_MODULE, [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Workqueue: writeback wb_workfn (flush-254:49)
Call trace:
 f2fs_is_cp_guaranteed+0x70/0x98
 f2fs_inplace_write_data+0x174/0x2f4
 f2fs_do_write_data_page+0x214/0x81c
 f2fs_write_single_data_page+0x28c/0x764
 f2fs_write_data_pages+0x78c/0xce4
 do_writepages+0xe8/0x2fc
 __writeback_single_inode+0x4c/0x4b4
 writeback_sb_inodes+0x314/0x540
 __writeback_inodes_wb+0xa4/0xf4
 wb_writeback+0x160/0x448
 wb_workfn+0x2f0/0x5dc
 process_scheduled_works+0x1c8/0x458
 worker_thread+0x334/0x3f0
 kthread+0x118/0x1ac
 ret_from_fork+0x10/0x20

[1] https://bugzilla.kernel.org/show_bug.cgi?id=220575

The panic was caused by UAF issue w/ below race condition:

kworker
- writepages
 - f2fs_write_cache_pages
  - f2fs_write_single_data_page
   - f2fs_do_write_data_page
    - f2fs_inplace_write_data
     - f2fs_merge_page_bio
      - add_inu_page
      : cache page #1 into bio & cache bio in
        io->bio_list
  - f2fs_write_single_data_page
   - f2fs_do_write_data_page
    - f2fs_inplace_write_data
     - f2fs_merge_page_bio
      - add_inu_page
      : cache page #2 into bio which is linked
        in io->bio_list
						write
						- f2fs_write_begin
						: write page #1
						 - f2fs_folio_wait_writeback
						  - f2fs_submit_merged_ipu_write
						   - f2fs_submit_write_bio
						   : submit bio which inclues page #1 and #2

						software IRQ
						- f2fs_write_end_io
						 - fscrypt_free_bounce_page
						 : freed bounced page which belongs to page #2
      - inc_page_count( , WB_DATA_TYPE(data_folio), false)
      : data_folio points to fio->encrypted_page
        the bounced page can be freed before
        accessing it in f2fs_is_cp_guarantee()

It can reproduce w/ below testcase:
Run below script in shell #1:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"

Run below script in shell #2:
for ((i=1;i>0;i++)) do xfs_io -f /mnt/f2fs/enc/file \
-c "pwrite 0 32k" -c "fdatasync"

So, in f2fs_merge_page_bio(), let's avoid using fio->encrypted_page after
commit page into internal ipu cache.


Remediation:
CVE: CVE-2025-7269
Component: IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
Release date: 2025-07-08T19:57:54.506000+00:00

IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26188.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
macsec: sync features on RTM_NEWLINK
CVE: CVE-2025-39874
Component: kernel
Severity: None
Release date: 2025-09-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

macsec: sync features on RTM_NEWLINK

Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES:

 netdev_lock include/linux/netdevice.h:2761 [inline]
 netdev_lock_ops include/net/netdev_lock.h:42 [inline]
 netdev_sync_lower_features net/core/dev.c:10649 [inline]
 __netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819
 netdev_update_features+0x6d/0xe0 net/core/dev.c:10876
 macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533
 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
 call_netdevice_notifiers net/core/dev.c:2281 [inline]
 netdev_features_change+0x85/0xc0 net/core/dev.c:1570
 __dev_ethtool net/ethtool/ioctl.c:3469 [inline]
 dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502
 dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759

It happens because lower features are out of sync with the upper:

  __dev_ethtool (real_dev)
    netdev_lock_ops(real_dev)
    ETHTOOL_SFEATURES
      __netdev_features_change
        netdev_sync_upper_features
          disable LRO on the lower
    if (old_features != dev->features)
      netdev_features_change
        fires NETDEV_FEAT_CHANGE
	macsec_notify
	  NETDEV_FEAT_CHANGE
	    netdev_update_features (for each macsec dev)
	      netdev_sync_lower_features
	        if (upper_features != lower_features)
	          netdev_lock_ops(lower) # lower == real_dev
		  stuck
		  ...

    netdev_unlock_ops(real_dev)

Per commit af5f54b0ef9e ("net: Lock lower level devices when updating
features"), we elide the lock/unlock when the upper and lower features
are synced. Makes sure the lower (real_dev) has proper features after
the macsec link has been created. This makes sure we never hit the
situation where we need to sync upper flags to the lower.


Remediation:
Connector/J unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30706
Component: mysql-connector-java
Severity: Important
CVSS v3: 7.7/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-04-15T20:31:08.449000+00:00

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).  Supported versions that are affected are 9.0.0-9.2.0. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).


Remediation:
thunderbird: DNS rebinding circumvents CORS
CVE: CVE-2025-8036
Component: firefox
CWE: CWE-350
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-07-22T20:49:25.303000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Firefox caches CORS preflight responses across IP address changes. This allows circumventing CORS with DNS rebinding.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation: