Red Hat Enterprise Linux 9.0

Service monitor mac flow is not rate limited

Iperf3: possible denial of service

Libnbd: malicious nbd server may crash libnbd

Cpio: extraction allows symlinks which enables remote command execution

Jwcrypto: denail of service via specifically crafted jwe

Libssh: libssh: denial of service via sftp responses with unknown request ids

Race condition exists in the key generation and rotation functionality

Grub2: out-of-bounds read at fs/ntfs.c

389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn

Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure

Libsoup: libsoup: http request smuggling via duplicate content-length headers

Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()

Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing

Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block

Shim: out of bounds read when parsing mz binaries

A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht()

Libarchive: off by one error in build_ustar_entry_name() at archive_write_set_format_pax.c

Binutils: binutils: denial of service via crafted elf file

389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service

Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname

Libsoup: incomplete fix for cve-2026-2443: range suffix overflow in libsoup soupserver

Systemd-coredump: race condition that allows a local attacker to crash a suid program and gain read access to the resulting core dump

Xorg-x11-server: use-after-free bug in destroywindow

Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap

Pam: libpam: libpam vulnerable to read hashed password

Kernel: local dos vulnerability in scatterwalk_copychunks

Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk

Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal

Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.

Postgresql: role pg_signal_backend can signal certain superuser processes.

Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()

A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events. This issue results from the improper management of a reference count. This may allow an attacker to create a denial of service condition on the system.

A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.

A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic.

Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation