Red Hat OpenShift Container Platform 5.

Sssd: sssd: denial of service via memory exhaustion in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via out-of-bounds read in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via out-of-bounds read during passkey parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.14
• Open redirect

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

• Assisted Installer for Red Hat OpenShift Container Platform 2
• Red Hat OpenShift Container Platform 4
• Path traversal

Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

• Red Hat OpenShift Container Platform 4.16
• Red Hat OpenShift Container Platform 5
• CWE-501

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-280

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Gcc: libstdc++ integer overflow in `new` operator

• Red Hat Enterprise Linux 8
• Red Hat Hardened Images
• Memory corruption

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Cri-o: cri-o checkpoint restore bypasses destination security context

• Red Hat Confidential Compute Attestation
• Red Hat Enterprise Linux 8
• Privilege escalation

Cri-o: cri-o: insufficient validation during container checkpoint restore

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• Path traversal

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

• Red Hat Hardened Images
• Red Hat Ansible Automation Platform 2
• Path traversal

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via malformed pam v1 requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Device-mapper-multipath: local denial of service via blocking ipc send operations

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1322

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

• containers crun
• Red Hat Hardened Images
• Path traversal

Crun: crun: rootful krun with passt executes container payload as host root

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Privilege escalation

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-187

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Race condition

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• CWE-775

Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language header underscore bypass on unauthenticated login endpoints

• Red Hat OpenShift Container Platform 4.14
• Red Hat OpenShift Container Platform 4.15
• Denial of service

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Kata-containers: insufficient validation of createcontainer mount and storage rules in genpolicy

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• Path traversal

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

• vim
• Red Hat Hardened Images
• Code injection

Samba: ctdb fails to do integrity checking of received packets

• Red Hat Ceph Storage 9.2
• Red Hat Enterprise Linux 10
• CWE-353

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Denial of service

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Race condition

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Denial of service

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Race condition

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Path traversal

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Pcp: pcp: remote denial of service and information leakage

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Pcp: pcp: denial of service due to signed integer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control
• Authentication bypass

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-403

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Privilege escalation

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-755

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Memory corruption