Red Hat Enterprise Linux 7.0

It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable allowing access to users and roles information to all the users logged in to the system.

There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.

The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SG_IO buffer, which may leaking sensitive information to userspace.

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

Gimp: gimp: remote code execution via crafted paa file

Xorg-x11-server: selinux unlabeled glx pbuffer

A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local access can create a denial of service situation via NULL pointer dereference in ovl_posix_acl_create function in fs/overlayfs/dir.c. This can allow attackers with ability to create directories on overlayfs to crash the kernel creating a denial of service (DOS).

Heap-buffer-overflow in extractimagesection()

There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of how the activation key is supplied to convert2rhel because it involves how convert2rhel provides it to subscription-manager.

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.

Grub2: fs/bfs: integer overflow in the bfs parser.

A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.

Qemu-kvm: usb: assertion failure in usb_ep_get()

Xfig: fig2dev stack-overflow via read_objects

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.

Gimp: gimp: denial of service via crafted pvr image file

Libvirt: null pointer dereference in udevconnectlistallinterfaces()

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Xfig: fig2dev segmentation fault in read_arcobject

Xfig: transfig: fig2dev segmentation fault vulnerability

Openjpeg: denail of service via crafted image file

Libgepub: integer overflow in libgepub's epub archive handling

Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Gimp: gimp: denial of service due to stack buffer overflow in tim image loader

Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

Abrt: unsanitized systemd journal content written to dump directory files enables content injection

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

Polkit: polkit: denial of service via unbounded input processing through standard input

Sssd: out-of-bounds read in the sssd

Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files

Nano: nano: format string vulnerability leads to denial of service

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.