Red Hat Enterprise Linux 6.

Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-923

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Privilege escalation

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

• GNOME Evolution Data Server
• Red Hat Enterprise Linux 10
• Path traversal

Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: denial of service via av1 tile_list_obu parser byte/bit confusion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: multiple out-of-bounds reads in pcapparse ipv4/tcp header parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Abrt: unsanitized systemd journal content written to dump directory files enables content injection

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
• Other injection

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8
• Path traversal

Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking

• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8
• Race condition

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8
• Race condition

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Denial of service

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• CWE-126

389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Denial of service

Samba: denial of service against ad dc wins server

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
• Command injection

Gnutls: gnutls: information disclosure via timing side-channel in pkcs#7 padding removal

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-208

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• HTTP request smuggling

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Samba: vfs_worm does not block directory modification

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-280

Samba: group policy certificate enrollment uses http:// without validation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-345

Samba: samba: remote code execution in printing subsystem via unescaped job description

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

• Red Hat Enterprise Linux 10.0 Extended Update Support
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
• Memory corruption

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

• Red Hat Enterprise Linux 10.0 Extended Update Support
• Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
• Memory corruption

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-179

Libxml2: libxml2: denial of service via crafted xsd-validated document

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Libsoup: libsoup: http request smuggling via duplicate content-length headers

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• HTTP request smuggling

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption