# Red Hat Enterprise Linux 9.

Every CVE that names Red Hat Enterprise Linux 9 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Unbound: null pointer dereference in unbound](https://agentprime.io/advisories/CVE-2024-43167.md)
  `CVE-2024-43167` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 4 more · CVSS 2.8 Low · Not analysed yet · Published 8 Aug 2024 · Tags: Memory corruption
- [Qemu: denial of service via improper synchronization in qemu nbd server during socket closure](https://agentprime.io/advisories/CVE-2024-7409.md)
  `CVE-2024-7409` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2024 · Tags: CWE-662
- [Libnbd: nbd server improper certificate validation](https://agentprime.io/advisories/CVE-2024-7383.md)
  `CVE-2024-7383` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 3 more · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2024 · Tags: Weak cryptography or TLS
- [Gtk3: gtk2: library injection from cwd](https://agentprime.io/advisories/CVE-2024-6655.md)
  `CVE-2024-6655` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.0 High · Not analysed yet · Published 16 Jul 2024 · Tags: Code injection
- [Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c](https://agentprime.io/advisories/CVE-2023-39329.md)
  `CVE-2023-39329` · CVE record: Red Hat Red Hat AI Inference Server 3.2 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Jul 2024 · Tags: Denial of service
- [Openjpeg: malicious files can cause the program to enter a large loop](https://agentprime.io/advisories/CVE-2023-39327.md)
  `CVE-2023-39327` · CVE record: Red Hat Red Hat AI Inference Server 3.2 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 13 Jul 2024 · Tags: Denial of service
- [Networkmanager: denial of service](https://agentprime.io/advisories/CVE-2024-6501.md)
  `CVE-2024-6501` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 3.1 Low · Not analysed yet · Published 9 Jul 2024 · Tags: Denial of service
- [389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request](https://agentprime.io/advisories/CVE-2024-6237.md)
  `CVE-2024-6237` · CVE record: Red Hat Red Hat Directory Server 12.4 for RHEL 9 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: CWE-230
- [Openjpeg: denail of service via crafted image file](https://agentprime.io/advisories/CVE-2023-39328.md)
  `CVE-2023-39328` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 9 Jul 2024 · Tags: Denial of service
- [Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9](https://agentprime.io/advisories/CVE-2024-6409.md)
  `CVE-2024-6409` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 7.0 High · Critical (CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 8 Jul 2024 · Tags: CWE-364
- [Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss](https://agentprime.io/advisories/CVE-2024-6505.md)
  `CVE-2024-6505` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 5 Jul 2024 · Tags: Memory corruption
- [Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option](https://agentprime.io/advisories/CVE-2024-6126.md)
  `CVE-2024-6126` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 3 more · CVSS 3.2 Low · Not analysed yet · Published 3 Jul 2024 · Tags: Denial of service
- [Qemu-kvm: 'qemu-img info' leads to host file read/write](https://agentprime.io/advisories/CVE-2024-4467.md)
  `CVE-2024-4467` · CVE record: Red Hat Advanced Virtualization for RHEL 8.2.1 and 4 more · CVSS 7.8 High · Not analysed yet · Published 2 Jul 2024 · Tags: Memory corruption
- [Openssh: regresshion - race condition in ssh allows rce/dos](https://agentprime.io/advisories/CVE-2024-6387.md)
  `CVE-2024-6387` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 1.00 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-364
- [Poppler: pdfinfo: crash in broken documents when using -dests parameter](https://agentprime.io/advisories/CVE-2024-6239.md)
  `CVE-2024-6239` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 21 Jun 2024 · Tags: CWE-20
- [389-ds-base: malformed userpassword hash may cause denial of service](https://agentprime.io/advisories/CVE-2024-5953.md)
  `CVE-2024-5953` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 18 Jun 2024 · Tags: CWE-1288
- [Nano: running \`chmod\` and \`chown\` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file](https://agentprime.io/advisories/CVE-2024-5742.md)
  `CVE-2024-5742` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 12 Jun 2024 · Tags: Path traversal
- [Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force](https://agentprime.io/advisories/CVE-2024-3183.md)
  `CVE-2024-3183` · CVE record: Red Hat Red Hat Enterprise Linux 7 and 4 more · CVSS 8.1 High · Not analysed yet · Published 12 Jun 2024 · Tags: Weak cryptography or TLS
- [Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service](https://agentprime.io/advisories/CVE-2024-2698.md)
  `CVE-2024-2698` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 8.8 High · Not analysed yet · Published 12 Jun 2024 · Tags: Broken access control
- [Ca: token authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2023-4727.md)
  `CVE-2023-4727` · CVE record: Red Hat Red Hat Certificate System 10.4 EUS for RHEL-8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-305
- [Booth: specially crafted hash can lead to invalid hmac being accepted by booth server](https://agentprime.io/advisories/CVE-2024-3049.md)
  `CVE-2024-3049` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-345
- [Libndp: buffer overflow in route information length field](https://agentprime.io/advisories/CVE-2024-5564.md)
  `CVE-2024-5564` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.1 High · Not analysed yet · Published 31 May 2024 · Tags: Memory corruption
- [389-ds-base: potential denial of service via specially crafted kerberos as-req request](https://agentprime.io/advisories/CVE-2024-3657.md)
  `CVE-2024-3657` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 7.5 High · Not analysed yet · Published 28 May 2024 · Tags: CWE-20
- [389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c](https://agentprime.io/advisories/CVE-2024-2199.md)
  `CVE-2024-2199` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 28 May 2024 · Tags: CWE-20
- [Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash](https://agentprime.io/advisories/CVE-2024-4693.md)
  `CVE-2024-4693` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-672
- [Libvirt: stack use-after-free in virnetclientioeventloop()](https://agentprime.io/advisories/CVE-2024-4418.md)
  `CVE-2024-4418` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 8 May 2024 · Tags: CWE-562
- [Rpm-ostree: world-readable /etc/shadow file](https://agentprime.io/advisories/CVE-2024-2905.md)
  `CVE-2024-2905` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: Broken access control
- [Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)](https://agentprime.io/advisories/CVE-2024-2467.md)
  `CVE-2024-2467` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 3 more · CVSS 5.9 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: CWE-208
- [Sssd: race condition during authorization leads to gpo policies functioning inconsistently](https://agentprime.io/advisories/CVE-2023-3758.md)
  `CVE-2023-3758` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 7.1 High · Not analysed yet · Published 18 Apr 2024 · Tags: Race condition
- [Freeipa: specially crafted http requests potentially lead to denial of service](https://agentprime.io/advisories/CVE-2024-1481.md)
  `CVE-2024-1481` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-20
- [Qemu-kvm: net: assertion failure in update_sctp_checksum()](https://agentprime.io/advisories/CVE-2024-3567.md)
  `CVE-2024-3567` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 10 Apr 2024 · Tags: Denial of service
- [Qemu: virtio: dma reentrancy issue leads to double free vulnerability](https://agentprime.io/advisories/CVE-2024-3446.md)
  `CVE-2024-3446` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 8.2 High · Not analysed yet · Published 9 Apr 2024 · Tags: Memory corruption
- [Xorg-x11-server: use-after-free in procrenderaddglyphs](https://agentprime.io/advisories/CVE-2024-31083.md)
  `CVE-2024-31083` · CVE record: Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 4 more · CVSS 7.8 High · Not analysed yet · Published 5 Apr 2024 · Tags: Memory corruption
- [Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap](https://agentprime.io/advisories/CVE-2024-31082.md)
  `CVE-2024-31082` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.3 High · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-126
- [Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice](https://agentprime.io/advisories/CVE-2024-31081.md)
  `CVE-2024-31081` · CVE record: Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 4 more · CVSS 7.3 High · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-126
- [Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents](https://agentprime.io/advisories/CVE-2024-31080.md)
  `CVE-2024-31080` · CVE record: Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 4 more · CVSS 7.3 High · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-126
- [Rust-openssl: timing based side-channel can lead to a bleichenbacher style attack](https://agentprime.io/advisories/CVE-2024-3296.md)
  `CVE-2024-3296` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: CWE-208
- [Xz: malicious code in distributed source](https://agentprime.io/advisories/CVE-2024-3094.md)
  `CVE-2024-3094` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.91 · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-506
- [Pcp: exposure of the redis server backend allows remote command execution via pmproxy](https://agentprime.io/advisories/CVE-2024-3019.md)
  `CVE-2024-3019` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 8.8 High · Not analysed yet · Published 28 Mar 2024 · Tags: Information disclosure
- [Cockpit: command injection when deleting a sosreport with a crafted name](https://agentprime.io/advisories/CVE-2024-2947.md)
  `CVE-2024-2947` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 3 more · CVSS 7.3 High · Not analysed yet · Published 28 Mar 2024 · Tags: Command injection
- [Libvirt: negative g_new0 length can lead to unbounded memory allocation](https://agentprime.io/advisories/CVE-2024-2494.md)
  `CVE-2024-2494` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 6.2 Medium · Not analysed yet · Published 21 Mar 2024 · Tags: Denial of service
- [Gnutls: vulnerable to minerva side-channel information leak](https://agentprime.io/advisories/CVE-2024-28834.md)
  `CVE-2024-28834` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Mar 2024 · Tags: Weak cryptography or TLS
- [Gnutls: potential crash during chain building/verification](https://agentprime.io/advisories/CVE-2024-28835.md)
  `CVE-2024-28835` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 21 Mar 2024 · Tags: CWE-248
- [Osbuild-composer: race condition may disable gpg verification for package repositories](https://agentprime.io/advisories/CVE-2024-2307.md)
  `CVE-2024-2307` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: Weak cryptography or TLS
- [Libvirt: null pointer dereference in udevconnectlistallinterfaces()](https://agentprime.io/advisories/CVE-2024-2496.md)
  `CVE-2024-2496` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 5.0 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Memory corruption
- [Iperf3: possible denial of service](https://agentprime.io/advisories/CVE-2023-7250.md)
  `CVE-2023-7250` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: CWE-183
- [Unixodbc: out of bounds stack write due to pointer-to-integer types conversion](https://agentprime.io/advisories/CVE-2024-1013.md)
  `CVE-2024-1013` · CVE record: Red Hat Red Hat Enterprise Linux 6 and 3 more · CVSS 7.8 High · Not analysed yet · Published 18 Mar 2024 · Tags: CWE-823
- [Libvirt: off-by-one error in udevlistinterfacesbystatus()](https://agentprime.io/advisories/CVE-2024-1441.md)
  `CVE-2024-1441` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Mar 2024 · Tags: CWE-193
- [Libgcrypt: vulnerable to marvin attack](https://agentprime.io/advisories/CVE-2024-2236.md)
  `CVE-2024-2236` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-385
- [Pcp: unsafe use of directories allows pcp to root privilege escalation](https://agentprime.io/advisories/CVE-2023-6917.md)
  `CVE-2023-6917` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 3 more · CVSS 6.0 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: Race condition
- [Xorg-x11-server: heap buffer overflow in disabledevice](https://agentprime.io/advisories/CVE-2024-21886.md)
  `CVE-2024-21886` · CVE record: Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 4 more · CVSS 7.8 High · Not analysed yet · Published 28 Feb 2024 · Tags: Memory corruption
- [Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent](https://agentprime.io/advisories/CVE-2024-21885.md)
  `CVE-2024-21885` · CVE record: Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 4 more · CVSS 7.8 High · Not analysed yet · Published 28 Feb 2024 · Tags: Memory corruption
- [Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation](https://agentprime.io/advisories/CVE-2024-1488.md)
  `CVE-2024-1488` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 8.0 High · Not analysed yet · Published 15 Feb 2024 · Tags: Broken access control
- [Opensc: memory use after free in authentic driver when updating token info](https://agentprime.io/advisories/CVE-2024-1454.md)
  `CVE-2024-1454` · CVE record: Red Hat Red Hat Enterprise Linux 7 and 2 more · CVSS 3.4 Low · Not analysed yet · Published 12 Feb 2024 · Tags: Memory corruption
- [389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)](https://agentprime.io/advisories/CVE-2024-1062.md)
  `CVE-2024-1062` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 12 Feb 2024 · Tags: Memory corruption
- [Kernel: stack overflow problem in open vswitch kernel module leading to dos](https://agentprime.io/advisories/CVE-2024-1151.md)
  `CVE-2024-1151` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Feb 2024 · Tags: Memory corruption
- [Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access](https://agentprime.io/advisories/CVE-2024-0229.md)
  `CVE-2024-0229` · CVE record: Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 4 more · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2024 · Tags: Memory corruption
- [Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcu](https://agentprime.io/advisories/CVE-2024-1312.md)
  `CVE-2024-1312` · CVE record: kernel and 4 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Feb 2024 · Tags: Memory corruption
- [Kernel: null pointer dereference in \_\_nvmet_req_complete](https://agentprime.io/advisories/CVE-2023-6536.md)
  `CVE-2023-6536` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Memory corruption
- [Kernel: null pointer dereference in nvmet_tcp_execute_request](https://agentprime.io/advisories/CVE-2023-6535.md)
  `CVE-2023-6535` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/technology/red-hat-enterprise-linux-9.md>
Older: <https://agentprime.io/advisories/technology/red-hat-enterprise-linux-9.md?cursor=WyIyMDI0LTAyLTA3VDIxOjA0OjIxLjQwOTAwMFoiLCJDVkUtMjAyMy02NTM1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-enterprise-linux-9&cursor=WyIyMDI0LTA4LTA4VDIwOjI1OjI0LjcyMzAwMFoiLCJDVkUtMjAyNC00MzE2OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-enterprise-linux-9/?cursor=WyIyMDI0LTA4LTA4VDIwOjI1OjI0LjcyMzAwMFoiLCJDVkUtMjAyNC00MzE2OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.