Red Hat Enterprise Linux 8.0

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.

GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim

Opensc: multiple memory issues with pkcs15-init (enrollment tool)

GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.

The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Sssd: use-after-free crash in sssd' 'sssd_pam' process

Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability.

Platform: token exposed at importing project

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

Libssh: improper sanitation of paths received from scp servers

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory.

There is an open race window when writing output in the following utilities in GNU binutils version 2.35 and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as part of a script updating binaries across different users), an unprivileged user can trick these utilities into getting ownership of arbitrary files through a symlink.

A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a race problem. This flaw allows a local user privilege attacker to cause a denial of service (DoS) or a kernel information leak.

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing

Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS

Shim: out-of-bounds read printing error messages

Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file

Out-of-bounds read in swtpm

Potential buffer overflow in php_cli_server_startup_workers

Reachable assertion in dbus_set_host_name

Reachable assertion in avahi_rdata_parse

Reachable assertion in avahi_dns_packet_append_record

Reachable assertion in avahi_alternative_host_name

Reachable assertion in avahi_escape_label

Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c

Gnuplot: gnuplot segmentation fault on getannotatestring

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Gnuplot: gnuplot segmentation fault on canvas_text

Gnuplot: gnuplot segmentation fault on xstrftime

Gnuplot: gnuplot segmentation fault on x11_graphics