Red Hat Enterprise Linux 9.

Gstreamer1-plugins-ugly-free: gstreamer1-plugins-ugly-free: unbounded memory allocation in asfdemux simple index parser

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-345

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Parted: parted: denial of service via heap buffer overflow during fat16 resize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Parted: parted: heap-based buffer overflow via crafted fat32 filesystem image

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Nautilus: nautilus: arbitrary file deletion via trash symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Libarchive: libarchive: use-after-free via aliased mac metadata copy

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gimp: gimp: paa integer overflow out-of-bounds read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-1050

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Command injection

Luksmeta: missing slot-range validation permits out-of-gap device i/o

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-1285

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Path traversal

Evolution-data-server: local file disclosure via attach file:// uris

• GNOME evolution-data-server
• Red Hat Enterprise Linux 10
• Information disclosure

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: double offset bug in vhost log mapping calculation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-214

Clevis: clevis: pkcs#11 token pin written to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Authentication bypass

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Bluez: bluez: stack-based out-of-bounds read in btmon via unvalidated num_keys in return_link_keys_evt()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gnome-remote-desktop: heap buffer overflow in gnome-remote-desktop vnc tls peek buffer handling allows remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: gimp: denial of service via null pointer dereference in xcf simulation parasite loading

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libhangul: null pointer dereference in hanja_new() when looking up a malformed hanja dictionary entry

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

• Red Hat Build of Podman Desktop
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Path traversal

Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-1284

Flatpak-builder: local file exfiltration via `file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Path traversal

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: heap buffer overflow in hot color filter on oversized image

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

M17n-lib: heap use-after-free write in re_init_ic()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption