Advisories · Technology
Red Hat Enterprise Linux 7.
Every CVE that names Red Hat Enterprise Linux 7 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.4 Medium
Gstreamer1-plugins-good: gstreamer: integer overflow and out-of-bounds read in qtdemux cea-608 closed-caption parser
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.0 High
Gvfs: gvfs-admin socket ownership race permits local root
- GNOME gvfs
- Red Hat Enterprise Linux 10
- Race condition
- CVSS 6.3 Medium
Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- CWE-84
- CVSS 3.0 Low
Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- CWE-178
- CVSS 4.3 Medium
Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Memory corruption
- CVSS 7.5 High
Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-187
- CVSS 6.1 Medium
Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 5.3 Medium
Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Path traversal
- CVSS 8.4 High
389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor
- Red Hat Directory Server 11.5 E4S for RHEL 8
- Red Hat Directory Server 11.7 E4S for RHEL 8
- Command injection
- CVSS 8.1 High
Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Code injection
- CVSS 5.8 Medium
Flatpak: flatpak: toctou race condition allows symlink redirection
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Race condition
- CVSS 5.9 Medium
Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service
- CVSS 6.5 Medium
Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Memory corruption
- CVSS 7.6 High
Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Memory corruption
- CVSS 5.9 Medium
Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Weak cryptography or TLS
- CVSS 4.7 Medium
Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Denial of service
- CVSS 5.3 Medium
Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Memory corruption
- CVSS 7.0 High
Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Memory corruption
- CVSS 7.0 High
Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Memory corruption
- CVSS 4.7 Medium
Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Denial of service
- CVSS 7.5 High
Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Memory corruption
- CVSS 7.8 High
Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Command injection
- CVSS 7.8 High
Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Command injection
- CVSS 7.0 High
Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Path traversal
- CVSS 7.8 High
Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection
- Red Hat Enterprise Linux 10
- Red Hat Cost Management On-Premise 1
- Race condition
- CVSS 7.9 High
Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority
- Red Hat Enterprise Linux 10
- Red Hat Cost Management On-Premise 1
- CWE-775
- CVSS 4.3 Medium
Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Open redirect
- CVSS 4.3 Medium
Gvfs: mtp: out-of-bounds read in do_read()
- GNOME gvfs
- Red Hat Enterprise Linux 10
- Memory corruption
- CVSS 6.5 Medium
Gvfs: afp: heap-based buffer overflow in dsi read path
- GNOME gvfs
- Red Hat Enterprise Linux 10
- Memory corruption
- CVSS 4.3 Medium
Gvfs: sftp: uninitialized heap disclosure in read_string()
- GNOME gvfs
- Red Hat Enterprise Linux 10
- Memory corruption
- CVSS 7.0 High
Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Command injection
- CVSS 5.3 Medium
Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
- Red Hat Certificate System 9
- Red Hat Enterprise Linux 10
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
- Red Hat Certificate System 9
- Red Hat Enterprise Linux 10
- Information disclosure
- CVSS 2.5 Low
Popt-devel: popt-static: short realloc in poptconfigfiletostring
- rpm-software-management popt
- Red Hat Hardened Images
- Memory corruption
- CVSS 8.8 High
Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
- WebKit
- WebKitGTK
- Memory corruption
- CVSS 7.0 High
Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Memory corruption
- CVSS 6.1 Medium
Gimp: heap out-of-bounds read and stack out-of-bounds access in psd loader from channel-count handling
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 6.1 Medium
Gimp: heap out-of-bounds read in pvr vq (compressed) decoder due to missing bounds check
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 6.1 Medium
Gimp: heap out-of-bounds read in ico loader via unvalidated used_clrs palette count
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 5.5 Medium
Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- CWE-129
- CVSS 6.1 Medium
Gimp: heap out-of-bounds reads in iff/ilbm loader from ham row size mismatch and nplanes=0
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 4.7 Medium
Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.5 High
Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Memory corruption
- CVSS 5.5 Medium
Gimp: stack vla size underflow denial of service in seattle
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 5.7 Medium
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.6 High
Bluez: stack overflow in name2utf8 causes dos and potential code execution
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 4.4 Medium
Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.8 High
Emacs: emacs: command injection via crafted filenames in tramp
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Command injection
- CVSS 7.8 High
Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Path traversal
- CVSS 6.5 Medium
389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- Memory corruption
- CVSS 6.5 Medium
File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Memory corruption
- CVSS 6.1 Medium
Gimp: unbounded stack vla and 21-byte stack over-read in pix (esm) loader
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.0 High
Gimp: integer overflow in pcx loader (planes=4) leads to heap overflow on 32-bit
- GNOME GIMP
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.1 High
Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Broken access control
- CVSS 7.0 High
Rpm: rpmbuild gettarspec() crafted tar member name → macro injection
- Red Hat Hardened Images
- Red Hat Enterprise Linux 10
- Code injection
- CVSS 8.8 High
Webkitgtk: use-after-free of jscvalue function parameters
- WebKit
- WebKitGTK
- Memory corruption
- CVSS 6.5 Medium
Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
- Red Hat Certificate System 10
- Red Hat Certificate System 11
- Weak cryptography or TLS
- CVSS 6.5 Medium
Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Memory corruption
- CVSS 7.5 High
Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Denial of service
- CVSS 4.3 Medium
Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Denial of service