Advisories · Technology

Red Hat Enterprise Linux 8.8 Extended Update Support.

Every CVE that names Red Hat Enterprise Linux 8.8 Extended Update Support among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-40547 CVE record

CVSS 8.3 High

Shim: rce in http boot support may lead to secure boot bypass
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Memory corruption
Not analysed yet 25 Jan 2024
CVE-2023-6816 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
- Red Hat Enterprise Linux 7
- Memory corruption
Not analysed yet 18 Jan 2024
CVE-2024-0646 CVE record

CVSS 7.0 High

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- Memory corruption
Not analysed yet 17 Jan 2024
CVE-2024-0553 CVE record

CVSS 7.5 High

Gnutls: incomplete fix for cve-2023-5981
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Information disclosure
Not analysed yet 16 Jan 2024
CVE-2024-0565 CVE record

CVSS 6.8 Medium

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client
- Linux kernel
- Red Hat Enterprise Linux 8
- Memory corruption
Not analysed yet 15 Jan 2024
CVE-2023-5455 CVE record

CVSS 6.5 Medium

Ipa: invalid csrf protection
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jan 2024
CVE-2023-7192 CVE record

CVSS 5.5 Medium

Kernel: refcount leak in ctnetlink_create_conntrack()
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service
- Denial of service
Not analysed yet 2 Jan 2024
CVE-2023-4641 CVE record

CVSS 4.7 Medium

Shadow-utils: possible password leak during passwd(1) change
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Authentication bypass
Not analysed yet 27 Dec 2023
CVE-2023-6546 CVE record

CVSS 7.0 High

Kernel: gsm multiplexing race condition leads to privilege escalation
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- CWE-366
Not analysed yet 21 Dec 2023
CVE-2023-6478 CVE record

CVSS 7.6 High

Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
- Red Hat Enterprise Linux 7
- Memory corruption
Not analysed yet 13 Dec 2023
CVE-2023-6377 CVE record

CVSS 7.8 High

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
- Red Hat Enterprise Linux 7
- Memory corruption
Not analysed yet 13 Dec 2023
CVE-2023-5870 CVE record

CVSS 2.2 Low

Postgresql: role pg_signal_backend can signal certain superuser processes.
- Red Hat Advanced Cluster Security 4.2
- Red Hat Enterprise Linux 8
- Denial of service
Not analysed yet 10 Dec 2023
CVE-2023-5868 CVE record

CVSS 4.3 Medium

Postgresql: memory disclosure in aggregate function calls
- Red Hat Advanced Cluster Security 4.2
- Red Hat Enterprise Linux 8
- CWE-686
Not analysed yet 10 Dec 2023
CVE-2023-5869 CVE record

CVSS 8.8 High

Postgresql: buffer overrun from integer overflow in array modification
- Red Hat Advanced Cluster Security 4.2
- Red Hat Enterprise Linux 7
- Memory corruption
Not analysed yet 10 Dec 2023
CVE-2023-6610 CVE record

CVSS 7.1 High

Kernel: oob access in smb2_dump_detail
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 8 Dec 2023
CVE-2023-6606 CVE record

CVSS 7.1 High

Kernel: out-of-bounds read vulnerability in smbcalcsize
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 8 Dec 2023
CVE-2023-5981 CVE record

CVSS 5.9 Medium

Gnutls: timing side-channel in the rsa-psk authentication
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- CWE-208
Not analysed yet 28 Nov 2023
CVE-2023-42669 CVE record

CVSS 6.5 Medium

Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Denial of service
Not analysed yet 6 Nov 2023
CVE-2023-3961 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Samba: smbd allows client access to unix domain sockets on the file system as root
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Path traversal
Not analysed yet 3 Nov 2023
CVE-2023-5824 CVE record

CVSS 7.5 High

Squid: dos against http and https
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- CWE-755
Not analysed yet 3 Nov 2023
CVE-2023-4091 CVE record

CVSS 6.5 Medium

Samba: smb clients can truncate files with read-only permissions
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Broken access control
Not analysed yet 3 Nov 2023
CVE-2023-5178 CVE record

CVSS 8.8 High

Kernel: use after free in nvmet_tcp_free_crypto in nvme
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- Memory corruption
Not analysed yet 1 Nov 2023
CVE-2023-5367 CVE record

CVSS 7.8 High

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
- Red Hat Enterprise Linux 7
- Memory corruption
Not analysed yet 25 Oct 2023
CVE-2023-5633 CVE record

CVSS 7.8 High

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.8 Extended Update Support
- CWE-911
Not analysed yet 23 Oct 2023
CVE-2023-5557 CVE record

CVSS 7.5 High

Tracker-miners: sandbox escape
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- CWE-693
Not analysed yet 13 Oct 2023
CVE-2023-4732 CVE record

CVSS 4.7 Medium

Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- CWE-366
Not analysed yet 3 Oct 2023
CVE-2023-42753 CVE record

CVSS 7.0 High

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 7.7 Advanced Update Support
- Memory corruption
Not analysed yet 25 Sept 2023
CVE-2023-39418 CVE record

CVSS 3.1 Low

Postgresql: merge fails to enforce update or select row security policies
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.8 Extended Update Support
- CWE-1220
Not analysed yet 11 Aug 2023
CVE-2023-39417 CVE record

CVSS 7.5 High

Postgresql: extension script @substitutions@ within quoting allow sql injection
- Red Hat Advanced Cluster Security 4.2
- Red Hat Enterprise Linux 8
- SQL injection
Not analysed yet 11 Aug 2023
CVE-2023-4132 CVE record

CVSS 5.5 Medium

Kernel: smsusb: use-after-free caused by do_submit_urb()
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 3 Aug 2023
CVE-2023-3772 CVE record

CVSS 5.5 Medium

Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 25 Jul 2023
CVE-2023-33951 CVE record

CVSS 6.7 Medium

Kernel: vmwgfx: race condition leading to information disclosure vulnerability
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.8 Extended Update Support
- CWE-413
Not analysed yet 24 Jul 2023
CVE-2023-3812 CVE record

CVSS 7.8 High

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
- Memory corruption
Not analysed yet 24 Jul 2023
CVE-2023-3019 CVE record

CVSS 6.0 Medium

Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 24 Jul 2023
CVE-2023-3567 CVE record

CVSS 7.1 High

Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 24 Jul 2023
CVE-2023-33952 CVE record

CVSS 6.7 Medium

Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.8 Extended Update Support
- Memory corruption
Not analysed yet 24 Jul 2023
CVE-2023-34968 CVE record

CVSS 5.3 Medium

Samba: spotlight server-side share path disclosure
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Information disclosure
Not analysed yet 20 Jul 2023
CVE-2023-34967 CVE record

CVSS 5.3 Medium

Samba: type confusion in mdssvc rpc service for spotlight
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 20 Jul 2023
CVE-2023-34966 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Samba: infinite loop in mdssvc rpc service for spotlight
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Denial of service
Not analysed yet 20 Jul 2023
CVE-2022-2127 CVE record

CVSS 5.9 Medium

Samba: out-of-bounds read in winbind auth_crap
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 20 Jul 2023
CVE-2023-1989 CVE record

CVSS 7.0 High

Kernel: use after free bug in btsdio_remove due to race condition
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 8.6 Extended Update Support
- Memory corruption
Not analysed yet 11 Apr 2023