Red Hat Enterprise Linux 9.0

Squid: denial of service in http digest authentication

Squid: denial of service in ftp

A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Shim: rce in http boot support may lead to secure boot bypass

Gnutls: vulnerability in gnutls othername san export

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux distributions and does not affect the OpenSSH upstream project itself. The usage of sshpkt_disconnect() on an error, which does not terminate the process, allows an attacker to send an unexpected GSSAPI message type during the GSSAPI key exchange to the server, which will call the underlying function and continue the execution of the program without setting the related connection variables. As the variables are not initialized to NULL the code later accesses those uninitialized variables, accessing random memory, which could lead to undefined behavior. The recommended workaround is to use ssh_packet_disconnect() instead, which does terminate the process. The impact of the vulnerability depends heavily on the compiler flag hardening configuration.

Corosync: corosync: denial of service and information disclosure via crafted udp packet

Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Gnutls: vulnerability in gnutls certtool template parsing

Libssh: libssh: denial of service via zero-length input in ssh_get_hexa()

Kernel: ebpf: insufficient stack type checks in dynptr

Libsoup: libsoup: denial of service via use-after-free in soupserver during tls handshake

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

Dma reentrancy issue (incomplete fix for cve-2021-3750)

Openssh: regresshion - race condition in ssh allows rce/dos

Libssh: out-of-bounds read in sftp_handle()

Cri-o: malicious container can create symlink on host

Keycloak: reflected xss attack

Keycloak: client access via device auth request spoof

Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

Samba: group policy certificate enrollment uses http:// without validation

Glibc: buffer overflow in ld.so leading to privilege escalation

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

crypto: algif_aead - Revert to operating out-of-place

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()