Red Hat Codeready Linux Builder For IBM Z Systems

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

Glibc: buffer overflow in ld.so leading to privilege escalation

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Glib: integer overflow in in g_escape_uri_string()

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Yelp: arbitrary file read

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

Glibc: potential use-after-free in getaddrinfo()

There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.

Ghostscript: incomplete fix for cve-2020-16305

Shadow-utils: possible password leak during passwd(1) change