Red Hat OpenShift Container Platform 4.

Popt-devel: popt-static: short realloc in poptconfigfiletostring

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Cri-o: cri-o: unvalidated image env var causes daemon crash

• Red Hat OpenShift Container Platform 4
• CWE-1287

Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• Path traversal

Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-197

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

• vim
• Red Hat Hardened Images
• Code injection

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

• Red Hat Multicluster Global Hub 1.4.9
• Red Hat Multicluster Global Hub 1.5.8
• Broken access control

Samba: ctdb fails to do integrity checking of received packets

• Red Hat Ceph Storage 9.2
• Red Hat Enterprise Linux 10
• CWE-353

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Denial of service

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.

• Red Hat OpenShift Container Platform 4
• Open redirect

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-681

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Race condition

Popt-devel: popt-static: size_t underflow in singleoptionhelp

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths

• Red Hat OpenShift Container Platform 4
• CWE-345

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Denial of service

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Popt-devel: popt-static: off-by-one in poptstuffargs

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Race condition

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Path traversal

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Other injection

Samba: dns signing dos via tkey name cache exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-410

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Pcp: pcp: remote denial of service and information leakage

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Pcp: pcp: denial of service due to signed integer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control
• Authentication bypass

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-403

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Privilege escalation

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-755

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Memory corruption

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-212

Kronosnet: kronosnet: access control list bypass via link id spoofing on unencrypted dynamic links

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Authentication bypass

Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• CWE-61

Kronosnet: kronosnet: memory corruption and out-of-bounds access via malformed network packet defragmentation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

• Red Hat multicluster engine for Kubernetes 2.1
• Red Hat multicluster engine for Kubernetes 2.11
• Authentication bypass

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

• OpenSUSE libsolv
• Red Hat Enterprise Linux 10
• Memory corruption

Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.13
• Memory corruption
• CWE-116

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Memory corruption

Sssd: use-after-free crash in sssd' 'sssd_pam' process

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Memory corruption

Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-923

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption