huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
CVE: CVE-2025-38319
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table

The function atomctrl_initialize_mc_reg_table() and
atomctrl_initialize_mc_reg_table_v2_2() does not check the return
value of smu_atom_get_data_table(). If smu_atom_get_data_table()
fails to retrieve vram_info, it returns NULL which is later
dereferenced.


Remediation:
python-ply: Unsafe pickle file handling in Ply
CVE: CVE-2025-56005
Component: ply
CWE: CWE-502
Severity: Important
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-01-01T00:00:00+00:00

An arbitrary code execution vulnerability was discovered in PLY (Python Lex-Yacc). When an application uses PLY's undocumented picklefile parameter to load cached parser data, the library deserializes the pickle file without validation. If an attacker can supply or modify the pickle file being loaded, they can embed malicious code that executes automatically during the deserialization process, potentially allowing them to run arbitrary commands on the affected system.

Statement: This vulnerability rates as Important rather than Critical because it only affects applications using an undocumented parameter (picklefile) in legacy PLY versions 3.2-3.11, which was designed for an atypical use case (Jython environments with oversized parser tables). Exploitation requires the target application to have explicitly implemented this undocumented parameter in their code and depends on the attacker's ability to influence which pickle file gets loaded—whether through shared directory race conditions, configuration injection, supply chain compromise, or chaining with separate vulnerabilities like file upload or path traversal—making this a conditional, context-dependent vulnerability rather than a universally exploitable critical flaw.

Remediation:
cups-filters: Heap buffer overflow in rastertopclx filter may lead arbitrary code execution
CVE: CVE-2025-64524
Component: cups-filters
CWE: CWE-120
Severity: Moderate
CVSS v3: 6.5/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2025-11-20T22:22:00+00:00

A flaw was found in cups-filters. This vulnerability allows a heap buffer overflow and memory corruption, potentially leading to arbitrary code execution or a Denial of Service, via an unvalidated length parameter in the CompressData function of the rastertopclx filter. This can be exploited by an attacker with permissions to install a printer with a PPD (PostScript Printer Description) file or remotely via the CUPS (Common Unix Printing System) web interface.

Statement: Red Hat rates this Moderate. While the `rastertopclx` filter runs under the `lp` user, limiting direct root compromise, the vulnerability can be exploited remotely via the CUPS web interface by an attacker with low privileges to install a printer with a crafted PPD file. This could lead to a denial of service or potentially arbitrary code execution, impacting system availability.

Remediation:
To mitigate this issue, restrict network access to the CUPS service (port 631) to trusted networks only. This can be achieved by configuring firewall rules to limit inbound connections to port 631. Alternatively, disable remote administration of CUPS if not required. If the CUPS service is restarted or reloaded, ensure that the firewall rules or configuration changes persist.
Replication unspecified vulnerability (CPU Apr 2025)
CVE: CVE-2025-30683
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-15T20:30:59.435000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and  9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
CVE: CVE-2025-7246
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:56:51.323000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26095.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
CVE: CVE-2025-14333
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2025-12-09T13:38:09.979000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
usb: gadget: f_acm: Refactor bind path to use __free()
CVE: CVE-2025-40094
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_acm: Refactor bind path to use __free()

After an bind/unbind cycle, the acm->notify_req is left stale. If a
subsequent bind fails, the unified error label attempts to free this
stale request, leading to a NULL pointer dereference when accessing
ep->ops->free_request.

Refactor the error handling in the bind path to use the __free()
automatic cleanup mechanism.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
Call trace:
 usb_ep_free_request+0x2c/0xec
 gs_free_req+0x30/0x44
 acm_bind+0x1b8/0x1f4
 usb_add_function+0xcc/0x1f0
 configfs_composite_bind+0x468/0x588
 gadget_bind_driver+0x104/0x270
 really_probe+0x190/0x374
 __driver_probe_device+0xa0/0x12c
 driver_probe_device+0x3c/0x218
 __device_attach_driver+0x14c/0x188
 bus_for_each_drv+0x10c/0x168
 __device_attach+0xfc/0x198
 device_initial_probe+0x14/0x24
 bus_probe_device+0x94/0x11c
 device_add+0x268/0x48c
 usb_add_gadget+0x198/0x28c
 dwc3_gadget_init+0x700/0x858
 __dwc3_set_mode+0x3cc/0x664
 process_scheduled_works+0x1d8/0x488
 worker_thread+0x244/0x334
 kthread+0x114/0x1bc
 ret_from_fork+0x10/0x20


Remediation:
CVE: CVE-2025-7303
Component: IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
Release date: 2025-07-08T19:59:25.237000+00:00

IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26384.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Missing unregister call for normal commands may lead to use-after-free
CVE: CVE-2025-61663
Component: grub2
CWE: CWE-825
Severity: Moderate
CVSS v3: 4.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-11-18T00:00:00+00:00

A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.

Statement: This vulnerability has been rated as have the impact of Moderate by the Red Hat Product Security team. This decision was made based in the fact an attacker needs local or physical access to the machine, to execute the normal command after it was unloaded. Additionally the most likely outcome from an successful attack is a Denial of Crash by leading the grub2 to crash.

Remediation:
There's no available mitigation for this vulnerability.
DDL unspecified vulnerability (CPU Jul 2025)
CVE: CVE-2025-50094
Component: mysql
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-15T19:27:46.994000+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.42, 8.4.5 and  9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Remediation:
Use-After-Free in V8 JavaScript Engine
CVE: CVE-2025-0995
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-02-15T01:17:24.705000+00:00

Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2025-43342
Component: webkitgtk
CWE: CWE-20
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-09-23T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper checks.

Statement: To exploit this flaw, an attacker needs to trick a user into processing or loading malicious web content.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
Linux kernel: Denial of Service via NULL pointer dereference in PCI endpoint configfs during asynchronous sub-group creation
CVE: CVE-2025-71233
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel. A local user with administrative privileges can trigger a NULL pointer dereference, a type of memory corruption vulnerability, in the PCI endpoint configfs code. This occurs when a user removes a driver directory before an asynchronously created sub-group operation completes. Successful exploitation leads to a kernel crash, resulting in a Denial of Service (DoS).

Statement: A NULL pointer dereference can occur in the PCI endpoint configfs code because sub groups were created asynchronously using delayed work. If a user removes the driver directory before the delayed work runs the work handler can call configfs_register_group on freed or partially torn down objects and crash the kernel. For the CVSS the PR is H because writing to configfs and creating PCI endpoint function entries typically requires administrative privileges. The issue is not network reachable and is triggered by local filesystem operations on configfs entries. Impact is denial of service through a kernel crash and there is no clear indication of confidentiality or integrity impact from this NULL dereference.

Remediation:
iommu: Fix two issues in iommu_copy_struct_from_user()
CVE: CVE-2025-37900
Component: kernel
Severity: None
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix two issues in iommu_copy_struct_from_user()

In the review for iommu_copy_struct_to_user() helper, Matt pointed out that
a NULL pointer should be rejected prior to dereferencing it:
https://lore.kernel.org/all/86881827-8E2D-461C-BDA3-FA8FD14C343C@nvidia.com

And Alok pointed out a typo at the same time:
https://lore.kernel.org/all/480536af-6830-43ce-a327-adbd13dc3f1d@oracle.com

Since both issues were copied from iommu_copy_struct_from_user(), fix them
first in the current header.


Remediation:
powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'
CVE: CVE-2025-22094
Component: kernel
Severity: None
Release date: 2025-04-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'

Commit 176cda0619b6 ("powerpc/perf: Add perf interface to expose vpa
counters") introduced 'vpa_pmu' to expose Book3s-HV nested APIv2 provided
L1<->L2 context switch latency counters to L1 user-space via
perf-events. However the newly introduced PMU named 'vpa_pmu' doesn't
assign ownership of the PMU to the module 'vpa_pmu'. Consequently the
module 'vpa_pmu' can be unloaded while one of the perf-events are still
active, which can lead to kernel oops and panic of the form below on a
Pseries-LPAR:

BUG: Kernel NULL pointer dereference on read at 0x00000058
<snip>
 NIP [c000000000506cb8] event_sched_out+0x40/0x258
 LR [c00000000050e8a4] __perf_remove_from_context+0x7c/0x2b0
 Call Trace:
 [c00000025fc3fc30] [c00000025f8457a8] 0xc00000025f8457a8 (unreliable)
 [c00000025fc3fc80] [fffffffffffffee0] 0xfffffffffffffee0
 [c00000025fc3fcd0] [c000000000501e70] event_function+0xa8/0x120
<snip>
 Kernel panic - not syncing: Aiee, killing interrupt handler!

Fix this by adding the module ownership to 'vpa_pmu' so that the module
'vpa_pmu' is ref-counted and prevented from being unloaded when perf-events
are initialized.


Remediation:
drm/hisilicon/hibmc: fix the hibmc loaded failed bug
CVE: CVE-2025-39772
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-11T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/hisilicon/hibmc: fix the hibmc loaded failed bug

When hibmc loaded failed, the driver use hibmc_unload to free the
resource, but the mutexes in mode.config are not init, which will
access an NULL pointer. Just change goto statement to return, because
hibnc_hw_init() doesn't need to free anything.


Remediation:
Improper Check for Unusual or Exceptional Conditions in http-proxy-middleware
CVE: CVE-2025-32997
Component: http-proxy-middleware
CWE: CWE-754
Severity: Moderate
CVSS v3: 4.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2025-04-15T00:00:00+00:00

A flaw was found in http-proxy-middleware. The issue occurs because the fixRequestBody function proceeds even when bodyParser has failed, which could lead to unintended behavior.


Remediation:
For more about Red Hat Developer Hub, see References links
For more about Red Hat Developer Hub, see References links
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
CVE: CVE-2025-68287
Component: kernel
CWE: CWE-364
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-16T00:00:00+00:00

A use-after-free vulnerability was found in the DWC3 USB controller driver in the Linux kernel. Multiple unsynchronized execution paths can invoke dwc3_remove_requests() concurrently, leading to premature freeing of USB requests. When one path frees requests while another is still processing them, a use-after-free crash occurs.

Statement: This affects systems with DWC3-based USB controllers, commonly found in ARM SoCs. The race is triggered by USB reset events concurrent with function unbind operations (e.g., during adb root).

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
Insufficient resource pool in the core management mechanism
CVE: CVE-2025-20103
Component: microcode_ctl
CWE: CWE-410
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2025-05-13T21:02:15.127000+00:00

Insufficient resource pool in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable denial of service via local access.


Remediation:
prettier parseNestedCSS ReDoS
CVE: CVE-2025-8263
Component: prettier
CWE: CWE-1333
Severity: None
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-28T07:32:05.605000+00:00

A regular expression denial of service flaw has been discovered in the prettier code formatter tool. This flaw allows and attacker who has access to input source files to induce a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
f2fs: fix to do sanity check on sbi->total_valid_block_count
CVE: CVE-2025-38163
Component: kernel
Severity: None
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on sbi->total_valid_block_count

syzbot reported a f2fs bug as below:

------------[ cut here ]------------
kernel BUG at fs/f2fs/f2fs.h:2521!
RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521
Call Trace:
 f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695
 truncate_dnode+0x417/0x740 fs/f2fs/node.c:973
 truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014
 f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197
 f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810
 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838
 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888
 f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112
 notify_change+0xbca/0xe90 fs/attr.c:552
 do_truncate+0x222/0x310 fs/open.c:65
 handle_truncate fs/namei.c:3466 [inline]
 do_open fs/namei.c:3849 [inline]
 path_openat+0x2e4f/0x35d0 fs/namei.c:4004
 do_filp_open+0x284/0x4e0 fs/namei.c:4031
 do_sys_openat2+0x12b/0x1d0 fs/open.c:1429
 do_sys_open fs/open.c:1444 [inline]
 __do_sys_creat fs/open.c:1522 [inline]
 __se_sys_creat fs/open.c:1516 [inline]
 __x64_sys_creat+0x124/0x170 fs/open.c:1516
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94

The reason is: in fuzzed image, sbi->total_valid_block_count is
inconsistent w/ mapped blocks indexed by inode, so, we should
not trigger panic for such case, instead, let's print log and
set fsck flag.


Remediation:
Lock screen setting bypass in Firefox Focus for Android
CVE: CVE-2025-1941
Component: firefox
CWE: CWE-306
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-03-04T13:31:25.097000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Under certain circumstances, a user opt-in setting that Focus should require authentication before use could be bypassed (distinct from CVE-2025-0245).

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

This CVE is specific to Firefox Focus for Android. No Red Hat products are affected.

Remediation: