huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
MediaWiki: Vulnerability in authentication management
CVE: CVE-2025-6597
Component: MediaWiki
CVSS v3: 0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in MediaWiki, specifically within the `includes/auth/AuthManager.Php` program file. This vulnerability affects the authentication management component. The exact nature and impact of this flaw are not fully detailed in the available information, but it indicates a weakness in how MediaWiki handles user authentication.

Statement: The vulnerability in MediaWiki stems from its failure to consider user autocreation as a login event for security reauthentication purposes. This could impact MediaWiki instances running on Fedora 42 and Fedora 43 if user autocreation is enabled, potentially leading to unintended security bypasses during reauthentication flows.

Remediation:
USB: wdm: close race between wdm_open and wdm_wwan_port_stop
CVE: CVE-2025-37985
Component: kernel
CWE: CWE-826
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: wdm: close race between wdm_open and wdm_wwan_port_stop

Clearing WDM_WWAN_IN_USE must be the last action or
we can open a chardev whose URBs are still poisoned

Statement: The bug actual only if WMC Device Management functionality being used (that is for the cell phones compliant to the CDC WMC specification). It is about possibility of incorrect access to the device (can access after release of the device). It doesn't lead to kernel crash or other possibilities of attack, so the security impact is limited.

Remediation:
To mitigate this issue, prevent module cdc-wdm from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
bpf: Fix softlockup in arena_map_free on 64k page kernel
CVE: CVE-2025-21851
Component: kernel
CWE: CWE-667
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-03-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix softlockup in arena_map_free on 64k page kernel

On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y,
arena_htab tests cause a segmentation fault and soft lockup.
The same failure is not observed with 4k pages on aarch64.

It turns out arena_map_free() is calling
apply_to_existing_page_range() with the address returned by
bpf_arena_get_kern_vm_start().  If this address is not page-aligned
the code ends up calling apply_to_pte_range() with that unaligned
address causing soft lockup.

Fix it by round up GUARD_SZ to PAGE_SIZE << 1 so that the
division by 2 in bpf_arena_get_kern_vm_start() returns
a page-aligned value.

Statement: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.

For the Red Hat Enterprise Linux 9 to confirm the current state, inspect the sysctl with the command:

    cat /proc/sys/kernel/unprivileged_bpf_disabled

The setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
CVE: CVE-2025-54951
Component: CVE-2025-54951
Release date: 2025-01-01T00:00:00+00:00

A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds memory access in DevTools in Google Chrome
CVE: CVE-2025-4050
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-05-05T18:10:37.038000+00:00

Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Django: User enumeration via timing attack in mod_wsgi authentication
CVE: CVE-2025-13473
Component: Django
CWE: CWE-208
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Django. A remote attacker can exploit a timing attack vulnerability in the `django.contrib.auth.handlers.modwsgi.check_password()` function, which is used for authentication via the Apache `mod_wsgi` module. This allows the attacker to determine valid usernames on the system, leading to information disclosure.

Statement: This LOW impact vulnerability in Django allows for user enumeration via a timing attack when `mod_wsgi` authentication is utilized. An attacker could exploit timing differences in the `check_password()` function to determine valid usernames on affected Red Hat products that use Django with `mod_wsgi` for authentication, leading to information disclosure.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
LoongArch: BPF: Fix jump offset calculation in tailcall
CVE: CVE-2025-38723
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Fix jump offset calculation in tailcall

The extra pass of bpf_int_jit_compile() skips JIT context initialization
which essentially skips offset calculation leaving out_offset = -1, so
the jmp_offset in emit_bpf_tail_call is calculated by

"#define jmp_offset (out_offset - (cur_offset))"

is a negative number, which is wrong. The final generated assembly are
as follow.

54:	bgeu        	$a2, $t1, -8	    # 0x0000004c
58:	addi.d      	$a6, $s5, -1
5c:	bltz        	$a6, -16	    # 0x0000004c
60:	alsl.d      	$t2, $a2, $a1, 0x3
64:	ld.d        	$t2, $t2, 264
68:	beq         	$t2, $zero, -28	    # 0x0000004c

Before apply this patch, the follow test case will reveal soft lock issues.

cd tools/testing/selftests/bpf/
./test_progs --allow=tailcalls/tailcall_bpf2bpf_1

dmesg:
watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]


Remediation:
Enhance array handling (Oracle CPU 2025-01)
CVE: CVE-2025-21502
Component: openjdk
CWE: CWE-195
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2025-01-21T20:00:00+00:00

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to Oracle Java SE accessible. This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.


Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
drm/gma500: Fix null dereference in hdmi teardown
CVE: CVE-2025-40011
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-10-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/gma500: Fix null dereference in hdmi teardown

pci_set_drvdata sets the value of pdev->driver_data to NULL,
after which the driver_data obtained from the same dev is
dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is
extracted from it. To prevent this, swap these calls.

Found by Linux Verification Center (linuxtesting.org) with Svacer.


Remediation:
Insufficient data validation in Extensions
CVE: CVE-2025-0443
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2025-01-15T10:58:54.090000+00:00

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component
CVE: CVE-2025-13023
Component: firefox
CWE: CWE-787
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-11-11T15:47:13.943000+00:00

Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
x86/fpu: Fix NULL dereference in avx512_status()
CVE: CVE-2025-38689
Component: kernel
Severity: None
Release date: 2025-09-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/fpu: Fix NULL dereference in avx512_status()

Problem
-------
With CONFIG_X86_DEBUG_FPU enabled, reading /proc/[kthread]/arch_status
causes a warning and a NULL pointer dereference.

This is because the AVX-512 timestamp code uses x86_task_fpu() but
doesn't check it for NULL. CONFIG_X86_DEBUG_FPU addles that function
for kernel threads (PF_KTHREAD specifically), making it return NULL.

The point of the warning was to ensure that kernel threads only access
task->fpu after going through kernel_fpu_begin()/_end(). Note: all
kernel tasks exposed in /proc have a valid task->fpu.

Solution
--------
One option is to silence the warning and check for NULL from
x86_task_fpu(). However, that warning is fairly fresh and seems like a
defense against misuse of the FPU state in kernel threads.

Instead, stop outputting AVX-512_elapsed_ms for kernel threads
altogether. The data was garbage anyway because avx512_timestamp is
only updated for user threads, not kernel threads.

If anyone ever wants to track kernel thread AVX-512 use, they can come
back later and do it properly, separate from this bug fix.

[ dhansen: mostly rewrite changelog ]


Remediation:
Radare2: Memory Corruption via Argument Manipulation
CVE: CVE-2025-5641
Component: radare2
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-06-05T06:31:06.181000+00:00

A flaw was found in radare2. The `r_cons_is_breaked` function in `libr/cons/cons.c` experiences memory corruption due to improper handling of the `-T` argument, leading to potential crashes. This flaw allows a local attacker to provide maliciously crafted input, possibly resulting in a denial of service.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
OpenEXR Heap-Based Buffer Overflow
CVE: CVE-2025-48071
Component: openexr
CWE: CWE-122
Severity: Important
CVSS v3: 7.3/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Release date: 2025-07-31T20:13:14.436000+00:00

A heap based-buffer overflow flaw was found in OpenEXR. In affected versions, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep-scan-line EXR files with a maliciously forged chunk header.

Statement: No Red Hat products or offerings are affected by this vulnerability.

This vulnerability should be considered Important rather than Moderate because it allows a heap-based buffer overflow during decompression of ZIPS-packed deep scan-line EXR files with a forged chunk header, which directly impacts memory safety. Heap overflows in image parsing libraries are particularly dangerous as they occur in low-level, high-performance C++ code that often lacks additional runtime protections. This flaw can be exploited by simply supplying a crafted EXR file, enabling a remote attacker to trigger arbitrary memory writes and potentially achieve code execution within the context of the application processing the file.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Use-After-Free in StructTreeRoot class
CVE: CVE-2025-52885
Component: poppler
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.5/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2025-10-10T22:11:20.494000+00:00

A use-after-free vulnerability has been identified in Poppler’s StructTreeRoot class when processing specially crafted PDF documents. An attacker could exploit this flaw by persuading a user to open a malicious PDF file, or by placing such a file on a share that is later previewed, causing the application to reference freed memory. This can lead to unexpected behavior in the context of the application handling the PDF.

Statement: This flaw has been rated Moderate impact by Red Hat Product Security.
Exploitation requires a local user to open a maliciously crafted PDF file. Successful attacks could majorly lead to the application to crash. Because user interaction and local access are required, the likelihood of exploitation in typical environments is considered Moderate to Low.

Remediation:
No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability beyond the update recommendation.
Use after free in Qt
CVE: CVE-2025-5991
Component: qt
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2025-06-11T07:33:41.071000+00:00

A use-after-free vulnerability has been discovered in Qt's QHttp2ProtocolHandler function. This vulnerability only affects HTTP/2 handling and is the result of a race condition between HTTP body and error response handling.

Statement: The specific versions of Qt affected are not shipped in RedHat products.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown
CVE: CVE-2025-68214
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel. A race condition exists in the `timer_shutdown_sync()` function, where a timer's function pointer can be set to NULL while the timer is still active on another processor. This can be exploited by a local attacker to trigger a kernel warning, potentially leading to system instability or a denial of service.


Remediation:
vtk: Kitware VTK (Visualization Toolkit) contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader
CVE: CVE-2025-57107
Component: Kitware VTK
CVSS v3: 7.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Release date: 2025-10-31T00:00:00+00:00

Kitware VTK (Visualization Toolkit) contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Bluetooth: Fix error code in chan_alloc_skb_cb()
CVE: CVE-2025-22007
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix error code in chan_alloc_skb_cb()

The chan_alloc_skb_cb() function is supposed to return error pointers on
error.  Returning NULL will lead to a NULL dereference.


Remediation:
batman-adv: fix panic during interface removal
CVE: CVE-2025-21781
Component: kernel
Severity: None
Release date: 2025-02-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: fix panic during interface removal

Reference counting is used to ensure that
batadv_hardif_neigh_node and batadv_hard_iface
are not freed before/during
batadv_v_elp_throughput_metric_update work is
finished.

But there isn't a guarantee that the hard if will
remain associated with a soft interface up until
the work is finished.

This fixes a crash triggered by reboot that looks
like this:

Call trace:
 batadv_v_mesh_free+0xd0/0x4dc [batman_adv]
 batadv_v_elp_throughput_metric_update+0x1c/0xa4
 process_one_work+0x178/0x398
 worker_thread+0x2e8/0x4d0
 kthread+0xd8/0xdc
 ret_from_fork+0x10/0x20

(the batadv_v_mesh_free call is misleading,
and does not actually happen)

I was able to make the issue happen more reliably
by changing hardif_neigh->bat_v.metric_work work
to be delayed work. This allowed me to track down
and confirm the fix.

[sven@narfation.org: prevent entering batadv_v_elp_get_throughput without
 soft_iface]


Remediation:
virtio-net: fix received length check in big packets
CVE: CVE-2025-40292
Component: kernel
CWE: CWE-130
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-08T00:00:00+00:00

A null pointer dereference was found in the virtio-net driver in the Linux kernel. When receiving big packets, the length validation does not account for the MTU-based buffer sizing changes. A malicious host can announce incorrect buffer lengths, causing the driver to access NULL page pointers when processing oversized packets.

Statement: This requires a malicious or compromised hypervisor host to exploit. Guest VMs running on trusted hypervisors are not at significant risk. The vulnerability allows host-to-guest attacks in virtualized environments.

Remediation:
Drupal XSS vulnerability
CVE: CVE-2025-12848
Component: drupal
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2025-11-26T01:28:33.628000+00:00

Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious
filename containing JavaScript code (e.g., "<img src=1 onerror=alert(document.domain)>") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts
in the context of the victim's browser.
 
The issue is present in a third-party library and has been addressed in a patch available at  https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Ghostscript Argument Sanitization Vulnerability
CVE: CVE-2025-48708
Component: Ghostscript
CWE: CWE-212
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2025-05-23T00:00:00+00:00

A flaw was found in Artifex Ghostscript. This vulnerability may allow arbitrary code execution via a crafted PostScript document.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.