Red Hat Enterprise Linux 10.

Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• CWE-208

389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• CWE-329

Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-670

389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: heap buffer overflow in sasl_io_recv() via padded sasl unbind

• 389ds 389-ds-base
• Red Hat Directory Server 11.5 E4S for RHEL 8
• Memory corruption

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-1188

Freeipa: ipa: idm: freeipa: off-by-one buffer overflows in ipa-otpd oauth2.c during oauth2 device authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Hplip: incomplete fix for cve-2026-8631

• HPLIP
• Red Hat Enterprise Linux 10
• Memory corruption

Pipewire: pulse server alloca stack overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Pipewire: raop rtsp null deref

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Dhcpcd: dhcpcd infinite loop and out-of-bounds read via zero-length ipv6 nd option in router advertisement handling

• Red Hat Enterprise Linux 10
• Denial of service

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

• GNOME GLib
• Red Hat Enterprise Linux 10
• Memory corruption

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

• GNOME GLib
• Red Hat Enterprise Linux 10
• Path traversal

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

• GNOME GLib
• Red Hat Enterprise Linux 10
• CWE-193

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

• GNOME GLib
• Red Hat Enterprise Linux 10
• CWE-126

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

• GNOME GLib
• Red Hat Enterprise Linux 10
• CWE-126

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

• GNOME GLib
• Red Hat Enterprise Linux 10
• Memory corruption

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

• GNOME GLib
• Red Hat Enterprise Linux 10
• CWE-126

Sssd: use-after-free crash in sssd' 'sssd_pam' process

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Memory corruption

Spice-vdagent: path traversal in file transfer via unsanitized filename

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Information disclosure

Community.general: community.general keyring_info — os keyring passphrase returned in plaintext

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Information disclosure

Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-923

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

• Red Hat Enterprise Linux AI 3.3 for RHEL 9
• Red Hat Enterprise Linux AI 3.4 for RHEL 9
• Memory corruption

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

• Red Hat Enterprise Linux AI 3.3 for RHEL 9
• Red Hat Enterprise Linux AI 3.4 for RHEL 9
• Memory corruption

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

• Red Hat Enterprise Linux AI 3.3 for RHEL 9
• Red Hat Enterprise Linux AI 3.4 for RHEL 9
• Memory corruption

Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Privilege escalation

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

• GNOME Evolution Data Server
• Red Hat Enterprise Linux 10
• Path traversal

Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gnutls: gnutls: use-after-free in gnutls_pkcs11_token_set_pin

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 files

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption