Red Hat Enterprise Linux 9.0

Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Xfig: transfig: fig2dev segmentation fault vulnerability

Xfig: fig2dev segmentation fault in read_arcobject

Openjpeg: denail of service via crafted image file

Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Kernel: cxgb4: use-after-free in ch_flower_stats_cb()

A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.

Libssh: libssh: denial of service via inefficient regular expression processing

Gimp: gimp: denial of service due to stack buffer overflow in tim image loader

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.

Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.

A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos

Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

Kernel: deadlock leading to denial of service in tipc_crypto_key_revoke

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Polkit: polkit: denial of service via unbounded input processing through standard input

Sssd: out-of-bounds read in the sssd

Nano: nano: format string vulnerability leads to denial of service

Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification

Mod_cluster/mod_proxy_cluster: stored cross site scripting

Keycloak: reflected xss via wildcard in oidc redirect_uri

A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

Mirror-registry: quay: quay: server-side request forgery via open redirect vulnerability in web interface

Samba: type confusion in mdssvc rpc service for spotlight

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required, such as the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.

Libssh: missing checks for return values for digests

Samba: spotlight server-side share path disclosure

Gnutls: vulnerability in gnutls sct extension parsing

sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not. This is resolved in 8.18 and later versions with 'o' in srv_features.