Red Hat Enterprise Linux 9.0

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.

A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.

A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()

Tar: tar: hidden file injection via crafted archives

Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c

Shim: out-of-bound read in verify_buffer_sbat()

A vulnerability was found in the avahi library. This flaw allows an unprivileged user to make a dbus call, causing the avahi daemon to crash.

Sqlite: use-after-free bug in jsonparseaddnodearray

Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

Libxpm: out of bounds read on xpm with corrupted colormap

Libtiff: memory leak in tiffcrop.c

Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

Gimp: gimp: remote code execution via crafted paa file

Gimp: gimp: denial of service via signed integer overflow in fli file processing

Kernel: null pointer dereference vulnerability in nft_dynset_init()

Xorg-x11-server: selinux unlabeled glx pbuffer

Heap-buffer-overflow in extractimagesection()

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.

Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c

A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU.

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Kernel: refcount leak in ctnetlink_create_conntrack()

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).

Gimp: gimp: denial of service via integer overflow in playstation tim loader

Grub2: fs/bfs: integer overflow in the bfs parser.

Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.

Qemu-kvm: usb: assertion failure in usb_ep_get()

Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c

Kernel: stack overflow problem in open vswitch kernel module leading to dos

Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid

Gimp: gimp: denial of service via crafted pvr image file

Shadow-utils: possible password leak during passwd(1) change

Libvirt: null pointer dereference in udevconnectlistallinterfaces()

A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.

Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr

Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.