huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-10158: rsync: Rsync: Out of bounds array access via negative index
Component: rsync
Severity: Moderate
CWE: CWE-129 (Improper Validation of Array Index)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2025-11-18T14:24:19.210000+00:00

An out of bounds read flaw has been discovered in rsync. A malicious client acting as the receiver of an rsync file transfer can trigger an OOB read via a negative array index. The rsync client requires at least read access to the remote rsync module to trigger the issue.


Affected upstream versions: <= v3.4.1
Fixed upstream versions: v3.4
Upstream repository: https://github.com/RsyncProject/rsync
Upstream fix commit: 797e17fc4a6f15e3b1756538a9f812b63942686f
CVE-2025-10725: openshift-ai: Overly Permissive ClusterRole Allows Authenticated Users to Escalate Privileges to Cluster Admin
Component: openshift-ai
Severity: Important
CWE: CWE-266 (Incorrect Privilege Assignment)
CVSS v3: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2025-09-29T00:00:00+00:00

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster's confidentiality, integrity, and availability. The attacker can steal sensitive data, disrupt all services, and take control of the underlying infrastructure, leading to a total breach of the platform and all applications hosted on it.

Statement: Red Hat Security Ratings classify this as an Important and not Critical because it requires minimal authentication for the remote attacker to jeopardize an environment. Following https://access.redhat.com/security/updates/classification

Affected upstream versions: <= v2.8.0
Fixed upstream versions: 3.0.0, sha256:12c1d1066e75951aad1d333bcbc1675ba7a795b57744294c23decec1655709c7, sha256:43a8904396e55074ffb1afcfcd8fe6db0edcbc918a8ff8301b6b0920aea7eabf, sha256:cebc8815e03b772343b15d0a7dce8fad6fcc71dd437d871db5a3691472350803, sha256:db339d2d4f86af4efa695ef193d19e26b25fec80017fa2780833a4cd944e383b, sha256:dccc7c6cf920da7ffeadbad42f5727f2d58d54ceef399ac98441345d06ff10c4
Upstream repository: https://github.com/opendatahub-io/opendatahub-operator
Upstream fix commit: 070057ebd0882be0e397bee1daa18c36374a03c0
CVE-2025-10921: gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Component: gimp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-10-29T19:29:39.135000+00:00

A heap-based buffer-overflow in GIMP’s HDR (RGBE) file parsing (CVE-2025-10921 / ZDI-25-910) allows an attacker to execute arbitrary code when a user opens or is tricked into previewing a malicious HDR file. The flaw is caused by missing length validation before copying user-supplied HDR data into a heap buffer, enabling memory corruption and control of program flow.

Statement: This vulnerability is Important because it enables remote code execution in the context of the user’s GIMP process with relatively low prerequisites: an attacker only needs to supply a crafted HDR file and get the victim to open or preview it. Heap overflows in image-parsing code are especially dangerous because image loaders commonly operate on untrusted files and often run in the same process as the application’s UI and plugins; a successful overwrite of heap metadata or adjacent control data can lead to arbitrary instruction-pointer control (RCE). Although exploitation requires user interaction (opening/preview), the attack surface is large (attachments, downloads, web previews) and the payload can execute with the user’s privileges, potentially leading to system compromise or lateral movement if the user has elevated access.

Affected upstream versions: 3.0.4
Fixed upstream versions: GEGL_0_4_64
Upstream repository: https://gitlab.gnome.org/GNOME/gegl
Upstream fix commit: 0e68b7471dabf2800d780819c19bd5e6462f565f
CVE-2025-10922: gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Component: gimp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-10-29T19:29:42.905000+00:00

A heap-based buffer overflow vulnerability was discovered in GIMP’s DICOM (DCM) file parser. The flaw occurs because the application fails to properly validate the length of user-supplied data before copying it to a heap buffer. This can lead to arbitrary code execution when a user opens a specially crafted DCM image file.

Statement: This vulnerability is marked as Important rather than Critical, this flaw remains technically significant because it enables remote code execution through malformed image content. The vulnerability affects the file parsing layer of GIMP, meaning the malicious payload executes as soon as a crafted DCM file is opened. However, it is rated as Important instead of Critical because successful exploitation requires user interaction (e.g., manually opening a malicious file) and the attack surface is limited to local execution contexts rather than a network-exposed service. The absence of privilege escalation and the requirement for a user to interact with the file reduce the overall severity, though exploitation could still result in full process compromise.

Affected upstream versions: 3.0.4
Fixed upstream versions: GIMP_3_0_6
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 3d909166463731e94dfe62042d76225ecfc4c1e4
CVE-2025-10923: gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability
Component: gimp
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-10-29T19:29:46.493000+00:00

A remote code execution vulnerability exists in GIMP due to improper validation of user-supplied data during the parsing of WBMP (Wireless Bitmap) files. The flaw occurs because an integer overflow can happen before memory allocation, leading to a heap-based buffer overflow. An attacker can exploit this by convincing a user to open a crafted WBMP image file or visit a malicious page, allowing arbitrary code execution within the context of the application process.

Statement: While this flaw can lead to arbitrary code execution, it is categorized as Important rather than Critical due to its attack prerequisites. Exploitation requires user interaction — the victim must manually open a malicious WBMP image file in GIMP. Additionally, the vulnerability has a local attack vector (AV:L) and cannot be exploited remotely over a network without user participation. These constraints limit the automatic propagation or large-scale exploitation potential typically seen in critical vulnerabilities, even though the impact on confidentiality, integrity, and availability is high once triggered.

Affected upstream versions: 3.0.4
Fixed upstream versions: GIMP_3_0_6
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 2d2d39f3da1d0b01ca7d71ad2b7a8725ee92ed96
CVE-2025-10934: gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Component: gimp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-10-29T19:58:55.670000+00:00

A heap-based buffer overflow in GIMP’s X Window Dump (XWD) file parser allows an attacker to craft a malicious XWD file (or a web page that triggers opening one) that can overflow a heap buffer during parsing and lead to remote code execution in the context of the GIMP process. The flaw is tracked as CVE-2025-10934 and was disclosed by Trend Micro’s Zero Day Initiative on 29 Oct 2025; GIMP has published a fix.

Statement: Heap-based buffer overflows that occur during image-file parsing are high-risk because image libraries and editors routinely parse attacker-controlled files from email, the web, or shared drives; a successful overflow can corrupt heap metadata or function pointers and result in arbitrary code execution with the privileges of the GIMP process. Unlike a local information leak or read-only bug, this vulnerability enables control-flow hijacking (overwrite of heap-managed data or code pointers) when a user opens or previews a crafted XWD file — so an attacker only needs to get the victim to open a file or visit a page that causes the file to be loaded. The exploitability is increased when parsers perform large allocations based on unchecked length fields (the advisory describes missing validation of user-supplied lengths prior to copying into a heap buffer), which is a classic recipe for exploitable heap corruption. Because GIMP runs with the user’s privileges and is commonly installed on desktops, this makes the bug Important rather than merely Moderate.

Affected upstream versions: 3.0.4
Fixed upstream versions: GIMP_3_0_6
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 5c3e2122d53869599d77ef0f1bdece117b24fd7c
CVE-2025-10966: curl: Curl missing SFTP host verification with wolfSSH backend
Component: curl
Severity: Moderate
CWE: CWE-322 (Key Exchange without Entity Authentication)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-11-07T07:26:30.351000+00:00

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. As the wolfSSH backend was documented as incomplete and fail tests, it is not expected that many users execute this code in production.

Statement: This vulnerability doesn't affect any supported Red Hat product. This flaw affects only curl when built with wolfSSH backend support, meanwhile for Red Hat Enterprise Linux and other Red Hat products the default SSH backend being use is libssh. It's not possible to change this configuration in runtime, as it's a build time only configuration.

Affected upstream versions: 8.16.0 <= 8.16.0, 8.15.0 <= 8.15.0, 8.14.1 <= 8.14.1, 8.14.0 <= 8.14.0, 8.13.0 <= 8.13.0, 8.12.1 <= 8.12.1, 8.12.0 <= 8.12.0, 8.11.1 <= 8.11.1, 8.11.0 <= 8.11.0, 8.10.1 <= 8.10.1, 8.10.0 <= 8.10.0, 8.9.1 <= 8.9.1, 8.9.0 <= 8.9.0, 8.8.0 <= 8.8.0, 8.7.1 <= 8.7.1, 8.7.0 <= 8.7.0, 8.6.0 <= 8.6.0, 8.5.0 <= 8.5.0, 8.4.0 <= 8.4.0, 8.3.0 <= 8.3.0
Fixed upstream versions: curl-8_17_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: b011e3fcfb06d6c027859
CVE-2025-10990: rexml: REXML: Denial of Service via inefficient regex parsing
Component: rexml
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-25T00:00:00+00:00

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

Statement: This vulnerability is rated as a moderate severity because it allows attackers to exploit inefficient regex parsing in hex numeric character references (&#x...;), causing a ReDoS and impacting availability, it requires specific malicious input but does not affect confidentiality or integrity.

Satellite employs multiple versions of ReXML in the Puppet Agent and Server components across varying versions of Satellite:

- In Satellite 6.15 (on RHEL8), the Puppet Agent component uses ReXML version 7.28-0-1 and IS affected.

- In Satellite 6.15 (on RHEL8), the Satellite server component uses ReXML version 7.17.2-1 and is NOT affected.

- In Satellite 6.16 and 6.17 (on RHEL8 and RHEL9), the Puppet Agent component uses ReXML version 8.8.1-1 and is NOT affected.

- In Satellite 6.16 and 6.17 (on RHEL8 and RHEL9), the Satellite server component uses ReXML version 8.6.2-2 and IS affected.

To reiterate, only the Puppet Agent component in Satellite 6.15 and the Satellite server component in Satellite 6.16 and 6.17 are affected. Any other component/Satellite version combinations are considered not-affected.

Affected upstream versions: <= v3.3.8
Fixed upstream versions: 0:7.34.0-4.el8sat, 0:7.34.0-4.el9sat, 0:8.8.1-3.el8sat, 0:8.8.1-3.el9sat, 6.16.5.4, 6.17.5
Upstream repository: https://github.com/ruby/rexml
Upstream fix commit: ce59f2eb1aeb371fe1643414f06618dbe031979f
CVE-2025-11081: binutils: GNU Binutils out-of-bounds read
Component: binutils
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-09-27T22:02:08.438000+00:00

An out of bounds read flaw has been discovered in GNU bin utilities. This issue affects the function dump_dwarf_section of the file binutils/objdump.c. Performing manipulation results in out-of-bounds read. The attack is only possible with local access.


Affected upstream versions: 2.45
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: f87a66db645caf8cc0e6fc87b0c28c78a38af59b
CVE-2025-11082: binutils: GNU Binutils Linker heap-based overflow
Component: binutils
Severity: Moderate
CWE: CWE-209 (Generation of Error Message Containing Sensitive Information)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-09-27T22:32:09.144000+00:00

A head based buffer overflow flaw has been discovered in GNU bin utilities. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow. The attack is restricted to local execution.

Statement: Red Hat rates this vulnerability as Moderate as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the impact of this flaw will be restricted.

Affected upstream versions: 2.45
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: ea1a0737c7692737a644af0486b71e4a392cbca8
CVE-2025-11083: binutils: GNU Binutils Linker heap-based overflow
Component: binutils
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-09-27T23:02:08.428000+00:00

A head based buffer overflow flaw has been discovered in GNU bin utilities. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow. The attack must be carried out locally.

Statement: Red Hat rates this vulnerability as Moderate as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the impact of this flaw will be restricted.

Affected upstream versions: 2.45
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 9ca499644a21ceb3f946d1c179c38a83be084490
CVE-2025-11157: feast: Feast: Remote Code Execution via insecure YAML deserialization
Component: feast
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-01-01T07:03:57.277000+00:00

A flaw was found in Feast, specifically in the Kubernetes materializer job. An attacker with the ability to modify specific YAML configuration files can exploit an insecure deserialization vulnerability. This allows for the instantiation of arbitrary Python objects, leading to remote code execution on the worker pod. Successful exploitation could result in cluster takeover, data poisoning, and supply-chain sabotage.

Statement: This vulnerability is rated Important for Red Hat OpenShift AI because an attacker with low privileges and local access to the worker pod can modify specific YAML configuration files. This insecure deserialization allows for remote code execution, potentially leading to cluster takeover, data poisoning, and supply-chain sabotage. This affects Red Hat OpenShift AI versions 2.22, 2.25, and 3.0.

Affected upstream versions: unspecified < 0.54.0
Fixed upstream versions: 0.54.0
Upstream repository: https://github.com/feast-dev/feast
Upstream fix commit: b2e37ff37953b68ae833f6874ab5bc510a4ca5fb
CVE-2025-1118: grub2: commands/dump: The dump command is not in lockdown when secure boot is enabled
Component: grub2
Severity: Moderate
CWE: CWE-501 (Trust Boundary Violation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-02-18T18:00:00+00:00

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.

Statement: Red Hat Product Security has rated this vulnerability with Moderate severity as it requires high privileges to exploit it.

Fixed upstream versions: 1:2.12-15.el10_0
Upstream repository: https://git.savannah.gnu.org/cgit/grub.git
Upstream fix commit: 34824806ac6302f91e8cabaa41308eaced25725f
CVE-2025-11187: openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file
Component: openssl
Severity: Moderate
CWE: CWE-233 (Improper Handling of Parameters)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H)
Public date: 2026-01-27T00:00:00+00:00

A flaw was found in OpenSSL. When an application processes a maliciously crafted PKCS#12 file, an attacker can exploit a stack buffer overflow or a NULL pointer dereference. This can lead to a denial of service (DoS) by crashing the application, and in some cases, may enable arbitrary code execution. The vulnerability arises from the lack of validation for PBKDF2 salt and keylength parameters within the PKCS#12 file.

Statement: This vulnerability is rated Moderate for Red Hat. It affects OpenSSL versions 3.6, 3.5, and 3.4, where improper validation of PBMAC1 parameters in PKCS#12 MAC verification can lead to a stack buffer overflow or NULL pointer dereference. Exploitation requires an application to process a maliciously crafted PKCS#12 file, which is uncommon as these files are typically trusted. OpenSSL versions 3.3, 3.0, 1.1.1, and 1.0.2 are not affected as they do not support PBMAC1 in PKCS#12.

Affected upstream versions: 3.6.0 < 3.6.1, 3.5.0 < 3.5.5, 3.4.0 < 3.4.4
Fixed upstream versions: 3.4.4, 3.5.5, 3.6.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 8caf359d6e46fb413e8f5f0df765d2e8a51df4e8
CVE-2025-11412: binutils: GNU Binutils Linker elflink.c bfd_elf_gc_record_vtentry out-of-bounds
Component: binutils
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2025-10-07T22:02:08.093000+00:00

A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the bfd_elf_gc_record_vtentry function in the bfd/elflink.c file due to a missing sanity check, causing a crash and resulting in a denial of service.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with ld-new. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Affected upstream versions: 2.45
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 047435dd988a3975d40c6626a8f739a0b2e154bc
CVE-2025-11413: binutils: GNU Binutils Linker elflink.c elf_link_add_object_symbols out-of-bounds
Component: binutils
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2025-10-07T22:02:12.368000+00:00

A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds write in the bfd_putl64 function in the bfd/libbfd.c file due to an improper check, causing a crash and resulting in a denial of service.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds write is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with ld-new. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Affected upstream versions: 2.45
Fixed upstream versions: 2.46
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 72efdf166aa0ed72ecc69fc2349af6591a7a19c0
CVE-2025-11414: binutils: GNU Binutils Linker elflink.c get_link_hash_entry out-of-bounds
Component: binutils
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2025-10-07T22:32:07.740000+00:00

A flaw was found in binutils. Processing a specially crafted object file with the ld linker can trigger an out-of-bounds read in the get_link_hash_entry function in the bfd/elflink.c file due to an improper check, causing a crash and resulting in a denial of service.

Statement: This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this out-of-bounds read is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with ld-new. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.

Affected upstream versions: 2.45
Fixed upstream versions: 2.46
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: aeaaa9af6359c8e394ce9cf24911fec4f4d23703
CVE-2025-11429: keycloak-server: Too long and not settings compliant session
Component: keycloak-server
Severity: Moderate
CWE: CWE-613 (Insufficient Session Expiration)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2025-10-07T00:00:00+00:00

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created while "Remember Me" was active retain their extended session lifetime until they expire, overriding the administrator's recent security configuration change. This is a logic flaw in session management increases the potential window for successful session hijacking or unauthorized long-term access persistence. The flaw lies in the session expiration logic relying on the session-local "remember-me" flag without validating the current realm-level configuration.


Affected upstream versions: <= 1.3.0.Final
Fixed upstream versions: 26.2-12, 26.2.11-1, 26.4.1
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: a34094100716b7c69ae38eaed6678ab4344d0a1d