Red Hat Enterprise Linux 9.0

Spice-vdagent: path traversal in file transfer via unsanitized filename

Gstreamer1-plugins-bad: gstreamer1-plugins-bad: 1-byte heap out-of-bounds read in h.264 nal extension slice parser

Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Postgresql: memory disclosure in aggregate function calls

Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get

Postgresql: merge fails to enforce update or select row security policies

Openjpeg: malicious files can cause the program to enter a large loop

Gstreamer1-plugins-bad: gstreamer1-plugins-bad: global buffer overflow (oob read) in h.266/vvc vui parameter parser

Foreman: foreman: information disclosure via improper validation of nested request parameters

Libopensc: incorrect handling length of buffers or files in libopensc

389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler

Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init

Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc

Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc

Libopensc: incorrect handling of the length of buffers or files in pkcs15init

Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init

Libssh: libssh: information disclosure via proxycommand %r username expansion

Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Libxml2: unbounded relaxng include recursion leading to stack overflow

389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification

Netavark: podman: netavark may resolve hostnames to unexpected hosts

Opensc: memory use after free in authentic driver when updating token info

A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Grub2: grub2-set-bootflag can be abused by local (pseudo-)users

A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.

A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak.

Packagekitd: use-after-free in idle function callback

Gdk-pixbuf: uninitialized memory disclosure in gdkpixbuf gif lzw decoder

Libssh: libssh: denial of service via improper configuration file handling

Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.

Libssh: libssh: denial of service due to malformed sftp message

Libxml2: libxml2: denial of service via crafted xml catalogs

Libopensc: heap buffer overflow in openpgp driver when generating key

Libxml2: stack buffer overflow in xmllint interactive shell command handling