huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
CVE: CVE-2025-39985
Component: kernel
Severity: None
Release date: 2025-10-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow

Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.

Unfortunately, because the mcba_usb driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:

  $ ip link set can0 mtu 9999

After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:

	socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))

to inject a malicious CAN XL frames. For example:

	struct canxl_frame frame = {
		.flags = 0xff,
		.len = 2048,
	};

The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:

  1. the skb->protocol is set to ETH_P_CANXL which is valid (the
     function does not check the actual device capabilities).

  2. the length is a valid CAN XL length.

And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN frame.

This can result in a buffer overflow. The driver will consume cf->len
as-is with no further checks on these lines:

	usb_msg.dlc = cf->len;

	memcpy(usb_msg.data, cf->data, usb_msg.dlc);

Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs!

Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.


Remediation:
ext4: xattr: fix null pointer deref in ext4_raw_inode()
CVE: CVE-2025-68820
Component: kernel
CWE: CWE-252
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's ext4 filesystem extended attribute handling. When ext4_get_inode_loc() fails with an error such as -EFSCORRUPTED, the iloc.bh buffer head remains NULL. The ext4_xattr_inode_dec_ref_all() function lacks error checking and proceeds to call ext4_raw_inode() with the NULL buffer, causing a kernel crash.

Statement: This vulnerability was discovered by the Linux Verification Center using SVACE static analysis. It affects ext4 filesystems when processing extended attributes on corrupted inodes. The crash can be triggered by mounting a specially crafted or corrupted ext4 filesystem image. Normal filesystem operations on healthy filesystems are not affected.

Remediation:
null pointer dereference in PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp
CVE: CVE-2025-11000
Component: openbabel
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-09-26T03:32:05.999000+00:00

A vulnerability was determined in Open Babel. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: nf_tables: reject duplicate device on updates
CVE: CVE-2025-38678
Component: kernel
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-09-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject duplicate device on updates

A chain/flowtable update with duplicated devices in the same batch is
possible. Unfortunately, netdev event path only removes the first
device that is found, leaving unregistered the hook of the duplicated
device.

Check if a duplicated device exists in the transaction batch, bail out
with EEXIST in such case.

WARNING is hit when unregistering the hook:

 [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150
 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S                  6.16.0+ #170 PREEMPT(full)
 [...]
 [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150

Statement: A flaw in nf_tables allowed a chain/flowtable update batch to include the same netdevice more than once. This left the hook lists in an inconsistent state (one duplicate not properly unregistered), triggering kernel WARNs and risking a later crash during hook teardown. Exploitation requires local CAP_NET_ADMIN (e.g., via nft in the host or a privileged netns).
High privileges are required because only processes with administrative capabilities (e.g., CAP_NET_ADMIN) can create or update nftables chains or flowtables, so unprivileged users cannot directly trigger this condition.

Remediation:
In order to trigger the issue, it requires the ability to create user/net namespaces.

On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:

# echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
# sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.
Use after free in Cast in Google Chrome
CVE: CVE-2025-8578
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-08-07T01:30:38.991000+00:00

Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2025-26666
Component: Windows Media Remote Code Execution Vulnerability
Release date: 2025-04-08T17:23:07.837000+00:00

Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
btrfs: fix iteration of extrefs during log replay
CVE: CVE-2025-38382
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix iteration of extrefs during log replay

At __inode_add_ref() when processing extrefs, if we jump into the next
label we have an undefined value of victim_name.len, since we haven't
initialized it before we did the goto. This results in an invalid memory
access in the next iteration of the loop since victim_name.len was not
initialized to the length of the name of the current extref.

Fix this by initializing victim_name.len with the current extref's name
length.


Remediation:
Vuetify: Cross-Site Scripting (XSS) vulnerability in VDatePicker component
CVE: CVE-2025-8082
Component: Vuetify
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-12-12T18:33:07.244000+00:00

A flaw was found in Vuetify's VDatePicker component. This vulnerability allows unsanitized HTML to be inserted into the page, leading to a Cross-Site Scripting (XSS) attack via the 'title-date-format' property accepting a user-created function and assigning its output to the 'innerHTML' property without sanitization.

Statement: This vulnerability is rated Moderate for Red Hat as it affects the Vuetify `VDatePicker` component, allowing Cross-Site Scripting (XSS) via unsanitized input to the `title-date-format` property. This could lead to arbitrary HTML injection. Affected Red Hat community projects include `qownnotes` and `qgis` in EPEL and Fedora, which utilize Vuetify versions 2.x. Vuetify 2.x is End-of-Life and will not receive further updates for this issue.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
aiohttp: Denial of Service via specially crafted POST request
CVE: CVE-2025-69227
Component: aiohttp
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post() method, provided that Python optimizations are enabled. This could lead to an infinite loop, resulting in a Denial of Service (DoS) attack, making the affected application unavailable.

Statement: This vulnerability is rated Moderate for Red Hat products as it can lead to a Denial of Service (DoS) in applications utilizing the `aiohttp` library. Exploitation requires Python optimizations to be explicitly enabled (e.g., via `-O` or `PYTHONOPTIMIZE=1`) and the application to process POST requests using the `Request.post()` method. Red Hat products are affected if they meet these specific configuration and usage criteria.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.
media: imagination: fix a potential memory leak in e5010_probe()
CVE: CVE-2025-38228
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: imagination: fix a potential memory leak in e5010_probe()

Add video_device_release() to release the memory allocated by
video_device_alloc() if something goes wrong.


Remediation:
FFmpeg: Unchecked Return Value and Out-of-bounds Read vulnerability allows sensitive constant disclosure
CVE: CVE-2025-0518
Component: ffmpeg
CVSS v3: 4.8/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2025-01-16T16:45:10.761000+00:00

Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .

This issue affects FFmpeg: 7.1.

Issue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a

 https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
s390/pci: Fix missing check for zpci_create_device() error return
CVE: CVE-2025-37974
Component: kernel
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

s390/pci: Fix missing check for zpci_create_device() error return

The zpci_create_device() function returns an error pointer that needs to
be checked before dereferencing it as a struct zpci_dev pointer. Add the
missing check in __clp_add() where it was missed when adding the
scan_list in the fixed commit. Simply not adding the device to the scan
list results in the previous behavior.

Statement: Low-risk issue affecting only privileged code on s390 architecture. Cannot be triggered by unprivileged or remote users.

Remediation:
Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission
CVE: CVE-2025-27427
Component: org.apache.activemq/artemis-core-client
CWE: CWE-863
Severity: Low
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2025-04-01T07:26:59.994000+00:00

A flaw was found in Apache ActiveMQ Artemis. This vulnerability allows a user with createDurableQueue or createNonDurableQueue permissions to augment the routing-type of an address without the createAddress permission. When combined with the send permission and automatic queue creation, an attacker could send messages with unsupported routing-types, bypassing intended restrictions.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Inappropriate implementation in Permission Prompts
CVE: CVE-2025-1923
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-03-05T03:48:37.668000+00:00

Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Privilege escalation or denial of service due to improper buffer locking in ring-buffer
CVE: CVE-2025-38101
Component: kernel
CWE: CWE-413
Severity: Moderate
CVSS v3: 7.4/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-07-03T00:00:00+00:00

A flaw was found in the Linux kernel's ring-buffer component. A local attacker could exploit improper buffer locking in the `ring_buffer_subbuf_order_set()` function. This could lead to list corruption and other concurrency-related issues, potentially resulting in privilege escalation or a denial of service (DoS).

Statement: This MODERATE impact flaw in the Linux kernel's ring-buffer component could allow a local privileged attacker to cause a denial of service due to improper buffer locking. This vulnerability could even lead to a kernel information leak problem.

Remediation:
virtio-net: fix recursived rtnl_lock() during probe()
CVE: CVE-2025-38551
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-08-16T00:00:00+00:00

A flaw was found in the Linux kernel’s virtio-net driver, where a recursive rtnl_lock() could be triggered during device probing. The deadlock occurs when a VIRTIO_NET_S_ANNOUNCE request is received from the VMM while the driver is still in the probe stage. In this scenario, the config_work scheduled by virtio_config_changed_work() may invoke netdev_notify_peers(), which attempts to acquire rtnl_lock() while it is already held by virtnet_probe(). This issue results in a recursive lock acquisition and a potential system hang.

Statement: No Red Hat products or offerings are affected by this vulnerability.

Remediation:
Mitigation is either unavailable or does not meet Red Hat Product Security standards for usability, deployment, applicability, or stability.
CVE: CVE-2025-8651
Component: Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability
Release date: 2025-08-06T01:14:12.534000+00:00

Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the JKWifiService. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26307.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
iommu: Fix potential memory leak in iopf_queue_remove_device()
CVE: CVE-2025-21770
Component: kernel
CWE: CWE-401
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix potential memory leak in iopf_queue_remove_device()

The iopf_queue_remove_device() helper removes a device from the per-iommu
iopf queue when PRI is disabled on the device. It responds to all
outstanding iopf's with an IOMMU_PAGE_RESP_INVALID code and detaches the
device from the queue.

However, it fails to release the group structure that represents a group
of iopf's awaiting for a response after responding to the hardware. This
can cause a memory leak if iopf_queue_remove_device() is called with
pending iopf's.

Fix it by calling iopf_free_group() after the iopf group is responded.


Remediation:
Input: cros_ec_keyb - fix an invalid memory access
CVE: CVE-2025-40263
Component: kernel
Severity: None
Release date: 2025-12-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Input: cros_ec_keyb - fix an invalid memory access

If cros_ec_keyb_register_matrix() isn't called (due to
`buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains
NULL.  An invalid memory access is observed in cros_ec_keyb_process()
when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work()
in such case.

  Unable to handle kernel read from unreadable memory at virtual address 0000000000000028
  ...
  x3 : 0000000000000000 x2 : 0000000000000000
  x1 : 0000000000000000 x0 : 0000000000000000
  Call trace:
  input_event
  cros_ec_keyb_work
  blocking_notifier_call_chain
  ec_irq_thread

It's still unknown about why the kernel receives such malformed event,
in any cases, the kernel shouldn't access `ckdev->idev` and friends if
the driver doesn't intend to initialize them.


Remediation:
thunderbird: Memory safety bugs fixed in Firefox 135 and Thunderbird 135
CVE: CVE-2025-1020
Component: firefox
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-02-04T13:58:56.390000+00:00

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory

Remediation:
media: venus: Add a check for packet size after reading from shared memory
CVE: CVE-2025-39710
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: venus: Add a check for packet size after reading from shared memory

Add a check to ensure that the packet size does not exceed the number of
available words after reading the packet header from shared memory. This
ensures that the size provided by the firmware is safe to process and
prevent potential out-of-bounds memory access.


Remediation:
Inappropriate implementation in Autofill
CVE: CVE-2025-12440
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-11-10T20:00:19.833000+00:00

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
lostvip-com ruoyi-go GenTableDao.go SelectListByPage sql injection
CVE: CVE-2025-9410
Component: ruoyi-go
Release date: 2025-08-25T16:32:06.462000+00:00

A weakness has been identified in lostvip-com ruoyi-go up to 2.1. The affected element is the function SelectListByPage of the file modules/system/dao/GenTableDao.go. Executing manipulation of the argument isAsc/orderByColumn can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Access control flaw for team admins allows unauthorized team additions
CVE: CVE-2025-22449
Component: mattermost
CWE: CWE-863
Severity: Low
CVSS v3: 4.8/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-01-09T06:54:53.029000+00:00

A flaw was found in Mattermost. In certain versions, Mattermost fails to enforce invite permissions, which allows team admins with no permissions to invite users to their team by updating the "allow_open_invite" field via making their team public.


Remediation:
Open Asset Import Library Assimp LWO File LWOAnimation.cpp UpdateAnimRangeSetup heap-based overflow
CVE: CVE-2025-3158
Component: assimp
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-04-03T13:31:06.224000+00:00

A flaw has been found in the Open Asset Import Library (assimp). In affected versions, a malformed LWO file may trigger a heap-based buffer overflow, which may lead to an application crash or other undefined behavior.


Remediation:
NGINX ngx_mail_smtp_module vulnerability
CVE: CVE-2025-53859
Component: nginx
CWE: CWE-125
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-08-13T14:46:55.471000+00:00

A memory access flaw has been discovered in nginx. The ngx_mail_smtp_module might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory. As a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue occurs during the NGINX SMTP authentication process, requiring the attacker to prepare against the target system to extract the leaked data.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.