Red Hat Enterprise Linux 9.6 Extended Update Support.

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Weak cryptography or TLS

Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap buffer overflow during websocket client-frame masking

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap buffer overflow during websocket message reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-61

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-61

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-197

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)

• Red Hat
• Red Hat build of Quarkus 3.27.6.redhat
• CWE-409

Redis: redis: out-of-bounds read via crafted cluster bus packets

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 9.6 Extended Update Support
• Privilege escalation

Gvfs: gvfs-admin socket ownership race permits local root

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Race condition

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Cross-site scripting (XSS)

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Libxml2: double-free/uaf in libxml2 python bindings

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Authentication bypass

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Broken access control

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Authentication bypass

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gvfs: sftp: heap-based buffer overflow in read_reply()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

• WebKit
• WebKitGTK
• Memory corruption

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

• Red Hat Build of Apache Camel 3.33.3.SP1
• Red Hat build of Keycloak 26.6
• XML external entities (XXE)

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Webkitgtk: use-after-free of jscvalue function parameters

• WebKit
• WebKitGTK
• Memory corruption

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Privilege escalation

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-706

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

• GStreamer gst-plugins-good
• Red Hat Enterprise Linux 10
• Memory corruption

Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

• GStreamer gst-plugins-good
• Red Hat Enterprise Linux 10
• Memory corruption

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Libvirt: swtpm privilege escalation via symlink following

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
• Memory corruption

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Denial of service

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c)

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
• Memory corruption

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Other injection

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

Pcp: pcp: denial of service due to signed integer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control
• Authentication bypass

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-403

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Other injection